In September 2026, unidentified threat actors exploited undisclosed vulnerabilities in Citrix NetScaler ADC and Gateway, leading to urgent patches from the vendor.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-88771 | 9.5 | CRITICAL | Yes, added 2026-09-27 | 2026-09-30 |
| CVE-2026-88778 | 8.8 | HIGH | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations must patch their systems to avoid unauthorized access, which could disrupt operations and lead to potential legal and reputational damage.
Industries affected
This incident affects all industries that rely on Citrix NetScaler for edge security, including financial services, healthcare, and government.
Users affected
End users face the risk of data breaches and unauthorized access, necessitating immediate action to secure their systems.
