Citrix NetScaler Zero-Days (CVE-2026-88771/88772) Actively Exploited, Added to KEV

What changed · following since Sep 28 Oct 5 — CISA added Citrix NetScaler CVE-2026-88779 to the KEV Catalog on October 4 based on evidence of active exploitation.

Google's Threat Intelligence Group (GTIG) published defensive guidance on September 29 confirming it is tracking active exploitation of the Citrix NetScaler ADC and Gateway vulnerabilities, adding a major independent confirmation to CISA's KEV listing. Citrix disclosed eight NetScaler vulnerabilities on September 27, including two critical zero-days, CVE-2026-88771 and CVE-2026-88772, that were being exploited before a patch existed. CISA has now also listed CVE-2026-88779, extending the active-exploitation concern beyond the original zero-days and reinforcing the need to assess exposed NetScaler systems for compromise.

• GTIG confirmed on September 29 it is actively tracking exploitation of the NetScaler ADC and Gateway vulnerabilities and published defensive guidance for affected organizations.
• CVE-2026-88771 carries a CVSS v4 score of 9.5 and, per Citrix, affects every deployment on the vulnerable version even in default configuration.
• Citrix's September 27 bulletin covers eight CVEs total (CVE-2026-88771 through 88778) and ships fixes for all of them.
• CISA added CVE-2026-88771 and CVE-2026-88772 to the KEV Catalog, which under BOD 26-04 forces expedited remediation timelines for federal agencies.
• CISA added CVE-2026-88779, a Citrix NetScaler improper restriction of operations within the bounds of a memory buffer vulnerability, to the KEV Catalog on October 4 based on evidence of active exploitation.
• Some administrators reportedly took NetScaler appliances offline before patches were available, after watchTowr flagged unpatched RCE exploitation a day earlier.

Bottom line The KEV addition for CVE-2026-88779 broadens the NetScaler response: organizations should patch affected appliances and hunt for compromise across exposed systems.