Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

What it is

CISA's alert amplifying Citrix's disclosure of ten NetScaler ADC and Gateway vulnerabilities: CVE-2026-88771 through CVE-2026-88779, plus CVE-2026-107406. The page was updated on Oct. 2 and Oct. 9, 2026, and CISA may keep revising it. The page gives no affected or fixed version numbers. Those are in the Citrix bulletins it links.

How it works

• CVE-2026-88771 and CVE-2026-88772 are critical zero-days. Each can independently give remote code execution. CISA reports active global exploitation.
• CVE-2026-88779 is a denial of service, but only on deployments configured as a SAML Service Provider (SP) or Identity Provider (IdP).
• On unpatched systems, an attacker can use CVE-2026-88779 to force a reboot. This "accelerates conditions" for running code previously injected through CVE-2026-88771. A device that looks clean after a crash or reboot may therefore be carrying a payload.
• The page gives no mechanism for CVE-2026-88773 to CVE-2026-88778 or CVE-2026-107406.

Preconditions / Affected

• NetScaler ADC and NetScaler Gateway, with versions defined in Citrix's bulletins.
• CVE-2026-88779 matters only where the appliance is a SAML SP or IdP.
• KEV listing dates:
• CVE-2026-88771 and CVE-2026-88772: Sept. 27, 2026.
• CVE-2026-88779: Oct. 4, 2026.
• CVE-2026-107406: added to the alert Oct. 9, with no KEV status stated.

What to do

Order matters, because patching can destroy evidence:

1. Check for compromise before patching. Citrix publishes indicators of compromise through NetScaler Console, and its Security Bulletins carry further guidance.
2. Forward NetScaler logs to a SIEM or central log retention. Local logs can rotate quickly and overwrite artifacts.
3. If you suspect compromise, preserve forensic evidence before updating, because updates may reduce forensic visibility.
4. Apply the Citrix updates for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406 promptly. CISA acknowledges that updates can be complex and may require downtime.
5. If compromised, restore a known-good backup that pre-dates the suspected or confirmed compromise. Then rotate every restored secret: local account passwords, key-encryption keys and SSL certificates.
6. Follow Citrix's "Steps to Take if NetScaler ADC is Suspected to be Compromised". CISA's SIGMA detection rule can help find suspicious activity in log sources.

Caveats

• The SIGMA rule may change as CISA learns more.
• CISA says "at least some" of these CVEs have confirmed exploitation, so the status of the remaining ones is unclear.
• Patching alone does not remove code already injected through CVE-2026-88771, which is why the pre-patch compromise check comes first.