Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772) ยท updates https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence. en Thu, 22 Oct 2026 00:00:00 GMT Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772): Zscaler ThreatLabz reports staged log-poisoning attacks against CVE-2026-88771 that drop web shells and a FreeBSD implant. https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772#2026-10-22-4296eaa3 Thu, 22 Oct 2026 00:00:00 GMT critical <p><a href="https://cybersecuritytimes.com/zscaler-netscaler-rce-exploitation/">Source</a></p> Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772): Rapid7 details an intrusion that chained CVE-2026-88771 log poisoning with CVE-2026-88779 to get root, then installed PHP web shells, HA-aware persistence and a FreeBSD proxy agent, and staged NetScaler configs and keys for exfiltration (updated Oct 22). https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772#2026-10-19-f96c8b88 Mon, 19 Oct 2026 00:00:00 GMT critical <p><a href="https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/">Source</a></p> Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772): CISA updates its alert to include CVE-2026-107406, a separate critical SAML memory overflow (RCE or DoS) fixed in 14.1-73.46 and 13.1-64.29; earlier fixes do not cover it. https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772#2026-10-09-1f92f59b Fri, 09 Oct 2026 00:00:00 GMT critical <p><a href="https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html">Source</a></p> Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772): CISA adds the related SAML crash CVE-2026-88779 to KEV; attackers can use it to force a reboot that runs code injected through CVE-2026-88771. https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772#2026-10-04-924c4f47 Sun, 04 Oct 2026 00:00:00 GMT critical <p><a href="https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway">Source</a></p> Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772): Citrix publishes CTX697096 for CVE-2026-88771 through CVE-2026-88778 and confirms in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772; CISA adds both to KEV the same day. https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772#2026-09-27-23f1a4ed Sun, 27 Sep 2026 00:00:00 GMT critical <p><a href="https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html">Source</a></p>