CISA Adds Two Critical Zero-Day Vulnerabilities to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities, affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products, are being actively exploited by threat actors globally and can independently enable remote code execution. CISA urges federal agencies and all organizations to prioritize their remediation.