Citrix NetScaler zero-days exploited as CISA urges immediate patching

Widely used for remote access and load balancing, Citrix NetScaler ADC and NetScaler Gateway appliances are once again under attack. On September 27, the U.S. agency CISA flagged two critical vulnerabilities exploited before patches were released: CVE-2026-88771 and CVE-2026-88772. Each one alone allows remote code execution, and CISA says they are being actively exploited worldwide.

An expanding alert

CISA's alert has been updated several times and now covers ten CVEs (CVE-2026-88771 through 88779, and CVE-2026-107406):

• October 4: CVE-2026-88779 was added to the KEV catalog. It can cause a denial of service on appliances configured as a SAML service provider or identity provider. On an unpatched system, an attacker could also use it to force a restart, which could allow code previously injected via CVE-2026-88771 to run.
• October 9: CVE-2026-107406 was added. It is covered by a separate Citrix bulletin.

Recommendations

CISA stresses the order of operations:

• First, look for signs of compromise (Citrix provides indicators through NetScaler Console) and preserve evidence, because updating can erase information useful to the investigation.
• Then install the fixed versions listed in the Citrix bulletins as quickly as possible.
• Send NetScaler logs to a SIEM: local logs rotate quickly.
• If compromised, restore a clean backup from before the attack, then rotate all secrets: local account passwords, key encryption keys (KEK) and TLS certificates.

SIGMA detection rules are available on CISA's GitHub repository. Because they are exposed to the internet and actively exploited, NetScaler appliances should be treated as the top priority.