NetScaler zero-days: Citrix ADC/Gateway — unauthenticated RCE actively exploited, emergency weekend patches (CVE-2026-88771 to CVE-2026-88778)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-88771, CVE-2026-88778, CVE-2026-88779, CVE-2026-88787
In mid-September 2026, unidentified threat actors began actively exploiting undisclosed zero-day vulnerabilities in Citrix NetScaler ADC and Gateway, consolidated edge appliances that act as reverse proxy, load balancer, WAF, firewall, and SSL VPN. Dutch government analysts and private incident responders detected suspicious attack traffic, and over the weekend of September 26 admins were urged to restrict or disconnect edge-facing deployments. By Sunday, Citrix released patches for a batch of unauthenticated remote code execution flaws tracked as CVE-2026-88771 through CVE-2026-88778, and CISA added the issues to its KEV catalog in an unusual Sunday update. Citrix's 2026 NetScaler response cadence dropped to 17 days from discovery to disclosure. A gap in sequential CVE IDs (CVE-2026-88779 through CVE-2026-88787) suggests further advisories may follow. All organizations running internet-facing NetScaler deployments are affected.
What to do
- Immediately apply the Citrix patches for CVE-2026-88771 through CVE-2026-88778 on all NetScaler ADC and Gateway deployments
- If patching is not yet possible, restrict or disconnect internet-facing NetScaler deployments as urged during the September 26 weekend advisories
- Hunt for signs of compromise, since attackers gained unauthenticated RCE on edge devices and may have achieved root/persistent access
- Keep patch pipelines primed for possible follow-up advisories covering the CVE-2026-88779 to CVE-2026-88787 ID gap
- Maintain accurate asset inventory of all edge appliances and rehearse emergency patching procedures
Sources
All live incidents on Threat Watch
