On September 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both affect Citrix NetScaler ADC and NetScaler Gateway, and both were reported as actively exploited zero-days. Administrators should verify their software versions, apply the appropriate Citrix security updates, and investigate potential compromise.
The September 27 announcement matters because NetScaler appliances often sit at the edge of enterprise networks, handling application delivery and remote access. A vulnerability in these systems can put more than the appliance itself at risk.
CISA’s alert accompanied a wider Citrix disclosure covering eight vulnerabilities. However, the two vulnerabilities added to the KEV Catalog were the immediate priority because exploitation had been observed in the wild. This report explains what CISA announced, what distinguishes the two CVEs, and what security teams should do next.
What CISA Announced on September 27, 2026
CISA added two critical Citrix NetScaler vulnerabilities to its KEV Catalog on September 27, 2026, following reports of active exploitation. The agency identified CVE-2026-88771 and CVE-2026-88772 in its alert and urged administrators to review Citrix’s security guidance.
The announcement covered Citrix NetScaler ADC and Citrix NetScaler Gateway. Citrix’s accompanying security bulletin disclosed eight vulnerabilities, numbered CVE-2026-88771 through CVE-2026-88778.
The distinction matters: the September 27 KEV addition concerned two of the eight disclosed vulnerabilities, not all eight.
CISA’s announcement also highlighted the zero-day nature of the threat. Attackers had exploited the vulnerabilities before the vendor’s public disclosure and availability of fixes, leaving organizations with potentially exposed appliances to address.
For security teams, this was not simply a routine vulnerability notification. It was a warning that the affected technology was already being targeted.
Which Citrix NetScaler CVEs Were Added to KEV?
CISA added CVE-2026-88771 and CVE-2026-88772 to its catalog. Citrix classifies both as critical and assigns each a CVSS 4.0 base score of 9.5. Their technical causes and exploitation preconditions differ, which affects how administrators assess exposure.
| Detail | CVE-2026-88771 | CVE-2026-88772 |
|---|---|---|
| Vulnerability type | Improper input validation | Memory overflow |
| Potential impact | Remote code execution | Remote code execution or denial of service |
| Authentication | Unauthenticated exploitation is possible | Depends on the vulnerable configuration and exploit path |
| Relevant precondition | No additional feature required | DTLS must be enabled |
| CVSS 4.0 score | 9.5 Critical | 9.5 Critical |
| KEV addition | September 27, 2026 | September 27, 2026 |
Source: Citrix Security Bulletin CTX697096.
CVE-2026-88771: Improper Input Validation
CVE-2026-88771 is an improper input validation vulnerability that can allow an unauthenticated attacker to execute arbitrary commands on an affected NetScaler appliance. Citrix states that all deployments running affected versions are vulnerable, including default configurations. No additional feature needs to be enabled.
That broad exposure makes version verification especially important. Administrators should not assume an appliance is safe simply because it does not use an unusual configuration or a particular optional feature.
CVE-2026-88772: Memory Overflow
CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service when DTLS is enabled.
Citrix identifies DTLS configuration as the relevant precondition and notes that DTLS is enabled by default on VPN virtual servers. As a result, administrators should inspect their actual configuration rather than assume the vulnerability is irrelevant because they did not deliberately enable DTLS.
Both vulnerabilities require attention, but the configuration checks for CVE-2026-88772 are not a substitute for updating affected appliances.
Why the KEV Listing Matters for US Organizations
The CISA KEV Catalog identifies vulnerabilities for which exploitation has been observed and helps organizations prioritize remediation. A KEV listing is not simply another way of expressing a high CVSS score: it communicates that the vulnerability has a known exploitation history.
For a security team managing dozens or hundreds of systems, this distinction can change the order of work. A vulnerability with confirmed exploitation may warrant faster action than another issue with a similar severity score but no known exploitation.
Federal agencies have specific remediation obligations
CISA’s Binding Operational Directive 26-04 establishes a risk-based approach to prioritizing security updates for Federal Civilian Executive Branch agencies. Organizations covered by the directive must follow the applicable requirements and deadlines.
Private companies should not assume that the directive automatically imposes the same legal obligations on them. Nevertheless, CISA’s catalog is a valuable resource for commercial organizations, managed service providers, and security operations teams deciding which known exploited vulnerabilities to address first.
The practical takeaway is straightforward: use KEV status as a prioritization signal, then apply the vendor’s affected-version and remediation guidance to the systems you actually operate.
What Citrix NetScaler Administrators Should Do
Administrators should verify whether their deployments run affected releases, apply the appropriate Citrix updates, and investigate signs of compromise where warranted. Patching addresses the software vulnerability, but it does not establish that an appliance was never compromised.
1. Identify affected appliances and versions
Check every relevant customer-managed NetScaler ADC and NetScaler Gateway deployment, including appliances used for remote access and hybrid environments.
Citrix’s September 27 bulletin identifies these affected release branches and fixed versions:
| Product release | Fixed version identified by Citrix |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 or later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 or later |
| NetScaler ADC 14.1-FIPS | 14.1-73.37 FIPS or later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1-37.279 or later |
These are the fixes identified in the original bulletin. Before making changes, consult the current Citrix security advisory to confirm the appropriate build for your deployment and any subsequent guidance.
2. Apply the appropriate security update
Use Citrix’s supported upgrade procedure for the relevant release branch. Include all applicable appliances in the environment, such as secondary or clustered systems, rather than updating only the primary device.
Citrix urges affected customers to install the relevant updated versions as soon as possible. Do not rely on a workaround unless the vendor explicitly documents and supports it for the specific issue.
For step-by-step instructions, consult the dedicated Citrix NetScaler patching guide rather than treating this news report as a full remediation manual.
3. Check for possible compromise
Because exploitation was observed before disclosure, administrators should assess whether affected appliances show signs of unauthorized activity.
Depending on the environment, this can include reviewing relevant authentication and administrative logs, investigating unexpected configuration changes, and following Citrix’s published indicators of compromise and forensic guidance.
Preserve relevant evidence before making changes that could destroy it. If compromise is suspected, involve the organization’s incident-response team and follow established containment and recovery procedures.
Important: A successful update does not prove that an attacker has been removed. Software remediation and incident investigation are separate tasks.
What Has Changed Since September 27?
The September 27 KEV addition remains a distinct historical event. Later NetScaler advisories should be treated as separate developments, with their own vulnerability identifiers and remediation requirements.
October 5: A separate NetScaler vulnerability enters KEV
CISA subsequently added CVE-2026-88779 to its KEV Catalog after reports of active exploitation. This was a separate vulnerability, not another name for either CVE from the September 27 announcement.
Administrators should therefore review later vendor advisories even if they have already addressed CVE-2026-88771 and CVE-2026-88772. A fix for one vulnerability should not be assumed to cover another unless the vendor explicitly confirms that relationship.
Why the historical date should remain unchanged
A security-news article should preserve the date of the event it reports. Later developments belong in a clearly dated update section, with links to their own advisories.
This approach allows readers to understand the original CISA announcement while finding newer information without confusing separate incidents or implying that all vulnerabilities share the same fix.
Official Advisories and Remediation Resources
Use the following primary sources to verify the announcement and determine the correct response for your environment.
- CISA: September 27 KEV announcement – The original government alert covering the two catalog additions.
- Citrix Security Bulletin CTX697096 – Technical descriptions, affected versions, preconditions, and fixed releases for the eight disclosed vulnerabilities.
- NVD: CVE-2026-88771 – The vulnerability’s NIST National Vulnerability Database record.
- NVD: CVE-2026-88772 – The corresponding record for the second vulnerability.
- CISA: Binding Operational Directive 26-04 – Federal guidance on risk-based security update prioritization.
For a potentially exposed appliance, the vendor’s current security bulletin and compromise-assessment guidance should take precedence over summaries in third-party reporting.
Frequently Asked Questions
1. Does a CISA KEV listing mean every NetScaler appliance has been compromised?
No. KEV inclusion means there is evidence that the vulnerability has been exploited; it does not prove that an attacker accessed every affected appliance. Organizations must assess their own exposure, software versions, logs, and available indicators of compromise to determine whether their systems may have been targeted.
2. Does patching remove an existing attacker foothold?
Not necessarily. A software update addresses the vulnerability covered by that update, but it does not guarantee that an attacker who gained access earlier has been removed. If an appliance may have been compromised, preserve evidence and follow the vendor’s investigation and recovery guidance alongside remediation.
3. Does BOD 26-04 apply to private US companies?
The directive establishes requirements for the Federal Civilian Executive Branch agencies within its scope. Private companies are not automatically subject to the same directive solely because CISA lists a vulnerability in KEV. However, the catalog remains useful for private organizations prioritizing security updates according to known exploitation risk.
4. Are CVE-2026-88779 and the September vulnerabilities the same issue?
No. CVE-2026-88779 is a separate NetScaler vulnerability that CISA added to KEV in October 2026. The September 27 announcement covered CVE-2026-88771 and CVE-2026-88772. Administrators should review the relevant vendor guidance for each identifier rather than assume that one update resolves every NetScaler vulnerability.
Conclusion
For organizations operating Citrix NetScaler ADC or NetScaler Gateway, the most important next step is to verify the deployed release against Citrix’s current security guidance and address any outstanding exposure promptly. If an appliance was exposed during the exploitation period, assess whether additional incident-response work is necessary rather than treating the update alone as proof of recovery.
Protect your environment: Start with the official Citrix security bulletin, then follow the remediation and investigation guidance applicable to your deployment.
Belayet Hossain is a Senior Systems Analyst and Web Infrastructure Expert with a Master’s in Computer Science & Engineering (CSE). Specializing in the “Meta” of the digital world, he applies his engineering background to rigorously test hosting services, domain strategies, and enterprise tech stacks. Belayet translates technical specs into actionable business intelligence. Connect with Belayet Hossain on Facebook, Twitter, or read more about Belayet Hossain.