CISA Alerts: New Critical Vulnerabilities in Citrix NetScaler

10/02/2026 6:00PM EST

Update October 9, 2026:

CISA has updated this Alert to: (1) include CVE-2026-107406; (2) include CVE-2026-88779 following its addition to the KEV Catalog on Oct. 4, 2026; (3) clarify the potential relationship between CVE-2026-88779 and CVE-2026-88771; and (4) emphasize the importance of promptly applying patches for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406, as well as reviewing Citrix guidance for suspected or confirmed compromises involving NetScaler ADC or Gateway.

Update October 2, 2026:

CISA has updated this Alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity.

CISA is amplifying Citrix’s disclosure of ten new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779, and CVE-2026-107406.

CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog on Sept. 27, 2026. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA received reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities globally.

CISA also added CVE-2026-88779 to the KEV Catalog on Oct. 4, 2026. In Citrix NetScaler deployments configured as a security assertion markup language (SAML) Service Provider (SP) or Identity Provider (IdP), CVE-2026-88779 can independently create a denial of service condition. In unpatched Citrix NetScaler deployments, cyber threat actors may also exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771.

Because updating Citrix NetScaler deployments can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation actions, and account for these vulnerabilities in their risk-management activities.

Given the potential consequences of successful exploitation and confirmed malicious activity involving at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories and install the relevant updated versions as soon as possible. CISA encourages system administrators and network defenders to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent Security Bulletins to support organizations in assessing potential compromise. CISA recommends organizations forward their NetScaler logs to a centralized security information and event management (SIEM) or log retention system, as local logs may rotate quickly and overwrite forensic artifacts.

Organizations that suspect compromise should preserve forensic evidence before applying updates, as updates may reduce forensic visibility. Further, organizations should restore a known good secure backup for their NetScaler deployment that pre-dates any confirmed or suspected compromise and rotate all restored secrets, including local account passwords, key-encryption keys, and SSL certificates. Review Citrix’s Steps to Take if NetScaler ADC is Suspected to be Compromised for best practices.

Organizations should review the following Citrix resources:

Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (Note: CISA may update this resource as more information becomes available):

CISA’s SIGMA Rules GitHub Repository

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. 