Critical Zero-Day security flaws Exploited in Citrix NetScaler ADC, Gateway

What happened

CISA has added CVE-2026-88771 (the public catalogue number for a specific software flaw) and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog . CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

Both are critical, zero-day (a flaw already being used in attacks before a fix exists) vulnerabilities that can independently enable remote code execution (running programs on a machine from somewhere else). Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.

If possible, users are encouraged to check for indication of compromise prior to patching. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document.

Key facts

• CISA has received — reports: and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally