September 28, 2026 is shaping up to be a defining day for network security teams worldwide. Citrix has confirmed that threat actors are actively exploiting two critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway, and CISA has simultaneously amplified the disclosure by cataloging a total of eight new CVEs affecting these widely deployed products. If your organization runs NetScaler infrastructure — and a significant portion of enterprise and government networks do — this is an all-hands situation requiring immediate attention.

The two confirmed exploited vulnerabilities are CVE-2026-88771 and CVE-2026-88772. CVE-2026-88771 is classified as an improper input validation flaw, a class of vulnerability that allows attackers to supply malformed or unexpected data to the application in ways the software was never designed to handle, potentially hijacking execution flow. CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer — commonly known as a buffer boundary issue — which can allow an attacker to overwrite adjacent memory and achieve arbitrary code execution. Both have been added to CISA's Known Exploited Vulnerabilities catalog, which carries a mandatory remediation deadline for federal agencies and serves as a strong signal to all organizations that real-world attacks are underway, not theoretical.

Beyond the two actively exploited flaws, Citrix has released patches for six additional vulnerabilities: CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778. While active exploitation of these six has not yet been publicly confirmed, the history of NetScaler vulnerabilities — including the Citrix Bleed incident of prior years — demonstrates that attackers move quickly to weaponize newly disclosed flaws in these products. The full set of eight CVEs should be treated with urgency, not just the two in the KEV catalog.

Why does NetScaler represent such an attractive target? NetScaler ADC and Gateway sit at the perimeter of enterprise networks, handling authentication, load balancing, and application delivery. Successful exploitation of an RCE vulnerability at this layer gives an attacker a foothold that is external-facing, highly privileged, and positioned to intercept credentials and session tokens before they ever reach internal systems. In past NetScaler campaigns, threat actors have harvested session tokens from memory, moved laterally into Active Directory environments, and deployed ransomware — all without needing valid credentials at the point of initial access.

Defensive priorities for security teams today:

- Apply Citrix's released security updates immediately, prioritizing CVE-2026-88771 and CVE-2026-88772 given confirmed active exploitation. Do not wait for a scheduled maintenance window.
- Consult the official Citrix Security Bulletin and CISA advisory to confirm which firmware and software versions are affected and which build numbers contain the fixes for all eight CVEs.
- If patching cannot be completed immediately, assess whether affected NetScaler appliances can be temporarily isolated or have management interfaces restricted to trusted IP ranges to reduce exposure surface.
- Review NetScaler logs for anomalous HTTP requests, unexpected process spawning, or unusual outbound connections originating from the appliance itself — these can be indicators of exploitation attempts or successful compromise.
- Check for signs of session token harvesting: unexplained authenticated sessions, logins from unusual geographies or IP addresses, or access patterns inconsistent with normal user behavior.
- Rotate any credentials, certificates, or session tokens that may have transited the NetScaler appliance in recent weeks, particularly if you cannot rule out prior compromise.
- Enable or verify that your SIEM is ingesting NetScaler syslog and audit events, and create or tune alerts for known exploitation indicators as threat intelligence becomes available from Citrix and CISA.
- Ensure your vulnerability management platform reflects the new CVEs and that asset owners for NetScaler infrastructure are notified with a clear remediation deadline aligned to CISA KEV timelines.
- Brief incident response teams now so they are prepared to execute forensic investigation procedures if exploitation is suspected, including memory acquisition from appliances where supported.

The broader lesson from today's disclosure is one the security community has seen repeatedly with perimeter appliances: these devices are high-value targets precisely because they are trusted, internet-facing, and often less rigorously monitored than endpoint or server infrastructure. Building detection coverage around network appliance behavior — not just workstations and servers — is a maturity investment that pays dividends when campaigns like this emerge.

This briefing is informational and intended to support your defensive response; always refer to official Citrix and CISA advisories for authoritative guidance, affected version lists, and the most current remediation instructions.