Act
archived
CISA KEV: Two Critical Citrix NetScaler RCE Zero-Days Actively Exploited
- Engineer — Act: Both CVEs are CISA KEV-listed with a public GitHub PoC and confirmed active exploitation — patch Citrix NetScaler ADC and Gateway to Citrix’s remediated versions immediately; treat any internet-exposed NetScaler appliance as potentially compromised pending verification.
- SOC/IR — Act: Active exploitation of perimeter appliances warrants an assume-breach posture — sweep for NetScaler-related IOCs and hunt for lateral movement or persistence artifacts on any NetScaler host going back to initial disclosure; check for anomalous management-plane access.
- Leader — Act: CISA-confirmed global exploitation of a critical edge appliance will generate board and customer questions — confirm whether your environment runs Citrix NetScaler ADC or Gateway, verify your engineering team has initiated emergency patching, and prepare a brief on exposure status before it surfaces externally.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.