CISA Mandates Immediate Mitigation for Actively Exploited Citrix NetScaler Zero-Days

The Cybersecurity and Infrastructure Security Agency (CISA) has set a due date of October 13, 2026, for organizations to apply mitigations for several critical, actively exploited zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products. These vulnerabilities, including CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779, could allow unauthenticated attackers to execute arbitrary commands or cause denial-of-service conditions. CISA urges immediate action due to confirmed global exploitation.