By Abinaya
Publication Date: 2026-09-28 09:28:00
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence showed they were being actively exploited in attacks.
The flaws affect Citrix NetScaler ADC and NetScaler Gateway appliances. They could allow unauthenticated attackers to take control of vulnerable systems remotely.
Tracked as CVE-2026-88771 and CVE-2026-88772, the vulnerabilities were added to CISA’s KEV catalog on September 27, 2026. Federal civilian executive branch agencies must apply vendor-recommended mitigations by September 30, 2026, under Binding Operational Directive 26-04.
CVE-2026-88771 is an improper input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway. An unauthenticated remote attacker could exploit the flaw to execute arbitrary commands on an affected appliance.
This creates a high-risk situation because internet-facing NetScaler devices often…
