[CLSTR]
< Back to all clusters
[TECHNOLOGY] · United States · 6 sources

started · updated

Part of situation: NetScaler product security vulnerabilities (7 clusters)

Citrix NetScaler vulnerabilities patched following active exploitation

Citrix NetScaler zero-day vulnerability remote code execution CISA cybersecurity

Citrix has released security updates to address multiple actively exploited zero-day vulnerabilities in its NetScaler ADC and NetScaler Gateway products.

Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS score of 9.5, were identified as being exploited in the wild before patches were available. CVE-2026-88771 allows unauthenticated attackers to execute arbitrary commands across all deployments, while CVE-2026-88772 is a memory overflow vulnerability affecting appliances with DTLS enabled.

A third vulnerability, CVE-2026-88779, is a memory overflow flaw with a CVSS score of 8.7. This flaw specifically impacts deployments using SAML authentication and can lead to denial of service. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this defect to its Known Exploited Vulnerabilities catalog, mandating that federal agencies apply patches by October 7, 2026.

Citrix has urged all customers to apply the available fixes immediately to mitigate the risk of remote code execution and unauthorized network access.

Entities

Bishop Fox · CISA · Citrix · NetScaler · Palo Alto Networks · WatchTowr

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Citrix discloses third actively exploited NetScaler zero-day in less than a week [cybernoz.com]
Cybersecurity Threat Advisory: Citrix NetScaler vulnerabilities [smartermsp.com]
Citrix NetScaler: Zwei Zero-Day-RCE-Lücken geschlossen [www.security-insider.de]
CVE-2026-88779: Citrix NetScaler Zero-Day Exploited in Targeted Attacks [www.technadu.com]
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline [thehackernews.com]
Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: two edge RCE flaws attacked before a fix existed [dev.to]