Citrix NetScaler Zero-Day Vulnerabilities Under Active Global Exploitation, CISA Orders Federal Agencies to Patch

Two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited globally. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these flaws to its Known Exploited Vulnerabilities catalog and mandated federal civilian agencies to apply patches by September 30, 2026. The vulnerabilities allow for remote code execution or denial of service, with CVE-2026-88771 being exploitable without authentication.