Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CISA is amplifying Citrix’s disclosure of eight vulnerabilities affecting NetScaler ADC/Gateway (CVE-2026-88771–88778), noting that two critical zero-day RCEs (CVE-2026-88771 and CVE-2026-88772) have been added to the Known Exploited Vulnerabilities catalog and are being actively exploited; organizations are urged to assess exposure, prioritize mitigation, check indicators of compromise, and preserve forensic evidence prior to applying updates.