Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited

• •CVE-2026-88771 and CVE-2026-88772 are critical zero-day vulnerabilities with CVSS scores of 9.5.
• •Both vulnerabilities allow unauthenticated remote code execution on vulnerable NetScaler appliances.
• •CISA has issued an urgent patch deadline for federal agencies by September 30, 2026.

Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, and set a patch deadline for federal agencies by September 30. Citrix has urged organizations to apply patches immediately and assess for potential compromises before patching. The vulnerabilities were discovered during incident investigations and were exploited before public disclosure. Affected systems are widely used in enterprise environments, making the impact potentially severe.