CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

CISA has placed two serious Citrix NetScaler ADC and Gateway bugs on its Known Exploited Vulnerabilities list after confirming they are being abused by attackers around the world. CVE-2026-88771 (CVSS 9.5) stems from poor input validation and lets an unauthenticated attacker run arbitrary commands on any NetScaler ADC or Gateway deployment, while CVE-2026-88772 (CVSS 9.5) is a memory-corruption flaw enabling remote code execution or denial-of-service, but only on systems with DTLS enabled — a setting turned on by default for VPN virtual servers. Citrix has shipped fixes in NetScaler ADC/Gateway 14.1-73.37 and later, 13.1-64.23 and later, plus corresponding 14.1-FIPS and 13.1-FIPS/NDcPP builds, and has published indicators of compromise via the NetScaler Console to help detect prior intrusions. Because patching these appliances is disruptive, CISA has ordered federal civilian agencies to remediate by September 30, 2026, and urges all organizations to check for compromise, isolate affected devices, rotate credentials, and rebuild from clean firmware if needed.