Marking what the federal government feels is a really big issue, an updated alert released to provide a SIGMA detection rule resource to help identify potentially suspicious activity affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products.
The eight vulnerabilities are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.
Additionally, CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, Zero Day vulnerabilities that can independently enable remote code execution. CISA received reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities on a global basis.
Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.
Given the potential consequences of successful exploitation and the fact malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.
If possible, users should check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise.
More Details
Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.
The following are various Citrix releases detailing the issue:
- Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 – Security Updates – Citrix Community
- Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
- Steps to Take if NetScaler ADC is Suspected of CompromiseÂ
Organizations can also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (CISA said it may update this resource as more information becomes available):