Citrix NetScaler RCE zero-day Vulnerabilities
What is the Attack? Threat actors are actively exploiting two critical remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Citrix confirmed that both vulnerabilities were exploited in the wild before security updates were available. CISA has subsequently added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and reported that threat intelligence confirms exploitation globally. CVE-2026-88771 is an improper input validation vulnerability that can allow an unauthenticated remote attacker to execute arbitrary commands. It affects NetScaler deployments without requiring an additional f
Read at FortiGuard Threat Signal reports
- Vendor
- Citrix
- Product
- NetScaler ADC / Gateway
- CVSS v4.0
- 9.5
- EPSS
- 0.78 (p100)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Edge / VPN / firewall
Why it ranks 97 (Critical)
- Exploitation observed in the wild
- CVSS v4.0 9.5 critical
- EPSS 0.78 (high probability of exploitation)
- Exposed product class: edge / VPN / firewall
- Widely deployed vendor product (Citrix)
- Covered by 13 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- FortiGuard Threat Signal reports (fortiguard.fortinet.com)
- CVE-2026-88771 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-88772 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.