Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited

Dqindia

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited

First seen 28 Sep 2026, 18:18 UTC • •82.3

Article Content

1 / 102

Browse articles

ThreatCluster •September 29, 2026 at 16:22 UTC

•CVE-2026-88771 and CVE-2026-88772 are critical zero-day vulnerabilities with CVSS scores of 9.5.
•Both vulnerabilities allow unauthenticated remote code execution on vulnerable NetScaler appliances.
•CISA has issued an urgent patch deadline for federal agencies by September 30, 2026.

Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, and set a patch deadline for federal agencies by September 30. Citrix has urged organizations to apply patches immediately and assess for potential compromises before patching. The vulnerabilities were discovered during incident investigations and were exploited before public disclosure. Affected systems are widely used in enterprise environments, making the impact potentially severe.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 2d ago How this analysis works

Timeline

2024-02-06

CVE-2024-0244 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2024-11-12

CVE-2024-8068 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-05-11

CVE-2026-42608 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-06-11

CVE-2026-35273 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-07-27

CVE-2026-63077 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-08-19

CVE-2026-19490 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-07

CVE-2026-86296 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-08

CVE-2026-86510 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-09

CVE-2026-85102 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-14

CVE-2026-90898 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (101)

Following this threat?

Track Slapshot, Citrix and CVE-2024-8068 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation On September 26, 2026, security firm watchTowr reported two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, allowing remote code execution (RCE) and actively exploited in the wild. Citrix has confirmed the existence of these vulnerabilities, tracked as CVE-2026-88771 and…