Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CISA-ALERT-2026-09-27-critical-zero-day-vulnerabilities-exploited-citrix-netscal · CISA · September 27, 2026

Summary

Update October 9, 2026 : CISA has updated this Alert to: (1) include CVE-2026-107406; (2) include CVE-2026-88779 following its addition to the KEV Catalog on Oct. 4, 2026; (3) clarify the potential relationship between CVE-2026-88779 and CVE-2026-88771; and (4) emphasize the importance of promptly applying patches for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406, as well as reviewing Citrix guidance for suspected or confirmed compromises involving NetScaler ADC or Gateway. Update October 2, 2026 :

From CISA, quoted as published. Check the source before acting.

Why it's on these mode pages

Maritime: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)
Pipeline: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)
Freight rail: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)
Passenger rail and transit: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)
Highway and motor carrier: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)
Postal and parcel: Vendor named in the text, vendor table: Citrix (network and remote-access gear used in every mode, all modes) (matched by rule)

Change history

November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com