Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments but claimed the problem was not connected to vulnerabilities reported last week that also caused alarm among cybersecurity experts.
CISA added CVE-2026-88779 (Citrix NetScaler) to its Known Exploited Vulnerabilities catalog on October 4, 2026, which means there is reliable evidence of exploitation in the wild. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
CISA lists this as exploited in the wild. Unpatched NetScaler ADC / Gateway systems are exposed to active attacks now.
Treat this as an emergency.
The critical vulnerabilities, which impact default configurations of NetScaler products, essentially give attackers a skeleton key to customers' networks.
Incident responders began warning of potential vulnerabilities in NetScaler Gateway products on Saturday before cybersecurity agencies in the Netherlands, U.S. and U.K. released advisories on Sunday confirming vulnerabilities. Citrix itself confirmed eight new vulnerabilities.
There are signs this may already be exploited, which usually shortens the time available to patch.
CISA added CVE-2026-88772 (Citrix NetScaler) to its Known Exploited Vulnerabilities catalog on September 27, 2026, which means there is reliable evidence of exploitation in the wild. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
CISA lists this as exploited in the wild. Unpatched NetScaler ADC / Gateway systems are exposed to active attacks now.
Treat this as an emergency.
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771 , CVE-2026-88772 , CVE-2026-88773 , CVE-2026-88774 , CVE-2026-88775 , CVE-2026-88776 , CVE-2026-88777 , and CVE-2026-88778 . CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog . Both are critical, zero-day…
CISA lists this as exploited in the wild. Unpatched NetScaler ADC / Gateway systems are exposed to active attacks now.
Treat this as an emergency.
The latest developments from the last 30 days, newest first.
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
Basis: Reporting by The Record by Recorded Future News
UPDATE: severity raised to critical: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns
Basis: CISA Known Exploited Vulnerabilities (government advisory)
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns
Basis: CISA Known Exploited Vulnerabilities (government advisory)
CVE-2026-88779 added to CISA KEV: Citrix NetScaler, Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Basis: CISA Known Exploited Vulnerabilities catalog
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
Basis: Reporting by Dark Reading
US, UK warn of exploited Citrix NetScaler zero-day bugs
Basis: Reporting by The Record by Recorded Future News
CVE-2026-88772 added to CISA KEV: Citrix NetScaler, Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Basis: CISA Known Exploited Vulnerabilities catalog
CVE-2026-88771 added to CISA KEV: Citrix NetScaler, Citrix NetScaler Improper Input Validation Vulnerability
Basis: CISA Known Exploited Vulnerabilities catalog
Citrix NetScaler
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler
Citrix NetScaler Improper Input Validation Vulnerability
Citrix NetScaler
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler
Citrix NetScaler Out-of-Bounds Read Vulnerability
Citrix NetScaler
Citrix NetScaler Memory Overflow Vulnerability
Citrix Session Recording
Citrix Session Recording Improper Privilege Management Vulnerability
Citrix Session Recording
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Citrix NetScaler ADC and Gateway
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Citrix NetScaler ADC and Gateway
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Citrix Content Collaboration
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Citrix Application Delivery Controller (ADC) and Gateway
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
Citrix Multiple Products Remote Code Execution Vulnerability
Citrix SD-WAN and NetScaler
Citrix SD-WAN and NetScaler SQL Injection Vulnerability
Citrix ShareFile
Citrix ShareFile Improper Access Control Vulnerability
