Small-business IT admins: two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are actively exploited in the wild, and CISA has added them to its Known Exploited Vulnerabilities catalog. These flaws, CVE-2026-88771 and CVE-2026-88772, are serious because they can allow remote code execution without authentication.
What happened
Citrix disclosed critical zero-day vulnerabilities affecting NetScaler ADC and NetScaler Gateway. These flaws have been observed being exploited in the wild, and they prompted a security bulletin with patch guidance. On the governmental side, CISA added these CVEs to its Known Exploited Vulnerabilities (KEV) catalog, signaling active threat activity and a need for rapid remediation. An updated advisory later noted ongoing exploitation globally and provided additional detection resources.
The affected products are widely used to publish and secure applications for many organizations, including small businesses and managed service providers. Exploitation can enable an attacker to take control over vulnerable devices, potentially opening the door to further intrusion or data access if left unpatched.
For context, Citrix and security researchers urge applying the official patches and following their hardening guidance as soon as possible. The goal is to close the exploitable window and reduce the risk of broader network access or data exposure.
Why it matters
- Immediate risk for many networks: NetScaler ADC and Gateway sit at the edge of many networks. A successful exploit can lead to remote code execution and broader access into the environment.
- Active exploitation means patching now: With KEV catalog entries and in-the-wild activity, this is a high-priority patch, not a later consideration.
- Cost of delay: Delaying patching can increase the chance of unauthorized access and complicate incident response.
- Relevance to SMBs and IT teams: If you rely on Citrix for remote access or app publishing, this affects affordability, uptime, and trust with customers and teammates.
Practical steps readers can take
- Inventory and verify: In your NetScaler management console, identify all NetScaler ADC and Gateway devices and check the current firmware/patch level against Citrix advisory CTX697096 (or the latest guidance from Citrix). Backup configurations before patching.
- Patch now: Apply the patch/update recommended by Citrix for the affected NetScaler appliances. Patch in a maintenance window and ensure backups are recent.
- Validate patching: After patching, verify the patch version on each device and confirm that management and VPN services come back online without errors.
- Harden and protect: Restrict admin access to trusted IPs, enable MFA for administrator accounts where available, rotate credentials, and review access controls for NetScaler management interfaces.
- Monitor and detect: Monitor for unusual login activity or unexpected admin actions. Review network logs for signs of exploitation attempts and align with KEV-related detections where possible.
- Plan for recovery: Ensure you have verified backups and a tested recovery plan in case of a post-exploitation incident.
Final thought
Act quickly but calmly: patching Citrix NetScaler now reduces the window for attackers and helps keep remote access and application delivery secure. If you’re unsure about the patching steps, start with a small group of devices in a test environment and follow the vendor’s instructions to the letter.