Because updating Citrix NetScaler appliances can be complex and may require downtime, Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.
Citrix NetScaler ADC (Application Delivery Controller) is an enterprise networking device and software platform that optimizes, secures, and controls the delivery of web and cloud applications.
Citrix NetScaler Gateway is a secure remote access and single sign-on solution that acts as a controlled entry point for users connecting to private enterprise environments, virtual apps, and desktops.
The vulnerability case numbers are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.
Additionally, CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, Zero Day vulnerabilities that can independently enable remote code execution. Furthermore, CISA received reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities on a global basis.
Given the potential consequences of successful exploitation and the fact malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.
If possible, users should check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise.
Should an organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 – Security Updates – Citrix CommunityÂ
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778Â
Steps to Take if NetScaler ADC ends up Suspected of CompromiseÂ