CVE-2026-88771
Known exploited · CISA KEV
CISA federal remediation date Sep 30 · date passed
Vulnerabilities & Exploits · Zero-Day Exploit
Citrix issued patches for NetScaler ADC and Gateway in September 2026 after attackers began exploiting undisclosed flaws mid-month, SecurityWeek reports. Dutch government threat analysts and private incident responders spotted suspicious attack traffic before Citrix’s release.
NetScaler combines several perimeter roles, including load balancing, a web application firewall, and virtual private network access. If an attacker gains root access to the appliance, they can control how the local network communicates with the outside world—not just the appliance itself.
For organizations relying on NetScaler to route traffic to multiple services, a compromise could expose those network paths and dependent systems. The reporting does not establish which deployments were breached or how long attackers had access, leaving the scope of exposure unclear.
1 source · 7h ago
Known exploited · CISA KEV
CISA federal remediation date Sep 30 · date passed
Known exploited · CISA KEV
CISA federal remediation date Oct 7 · date passed
CVSS 7.5 HIGH: predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.… EPSS 0.7% (53rd percentile).
SecurityWeek
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
originalPart of the PlainSec briefing for 2026-10-27
Every edition of this story: NetScaler zero-days put edge traffic control at stake