CISA Updates Guidance on Actively Exploited Citrix NetScaler ADC and Gateway Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has updated their October 9th alert to: (1) include CVE-2026-107406; (2) include CVE-2026-88779 following its addition to the Know Exploited Vulnerability (KEV) Catalog on October 4; (3) clarify the potential relationship between CVE-2026-88779 and CVE-2026-88771; and (4) emphasize the importance of promptly applying patches for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406 , as well as reviewing Citrix guidance for suspected or confirmed compromises involving NetScaler ADC or Gateway.

CISA has also updated their October 2nd alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity.

CISA is amplifying Citrix’s disclosure of ten new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779, and CVE-2026-107406.

They also added CVE-2026-88771 and CVE-2026-88772 to its KEV Catalog on September 27. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA received reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities globally.

CVE-2026-88779 was added to the KEV Catalog on October 4. In Citrix NetScaler deployments configured as a security assertion markup language (SAML) Service Provider (SP) or Identity Provider (IdP), CVE-2026-88779 can independently create a denial of service condition. In unpatched Citrix NetScaler deployments, cyber threat actors may also exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771.

Because updating Citrix NetScaler deployments can be complex and may require downtime, CISA issued this alert to help organizations assess exposure, prioritize mitigation actions, and account for these vulnerabilities in their risk-management activities.

Given the potential consequences of successful exploitation and confirmed malicious activity involving at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories and install the relevant updated versions as soon as possible. System administrators and network defenders are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent Security Bulletins to support organizations in assessing potential compromise. CISA has recommended organizations forward their NetScaler logs to a centralized security information and event management (SIEM) or log retention system, as local logs may rotate quickly and overwrite forensic artifacts.

Organizations that suspect compromise should preserve forensic evidence before applying updates, as updates may reduce forensic visibility. Further, organizations should restore a known good secure backup for their NetScaler deployment that pre-dates any confirmed or suspected compromise and rotate all restored secrets, including local account passwords, key-encryption keys, and SSL certificates. Review Citrix’s Steps to Take if NetScaler ADC is Suspected to be Compromised for best practices.

Organizations should review the following Citrix resources:

Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (Note: CISA may update this resource as more information becomes available):

CISA’s SIGMA Rules GitHub Repository