Act
archived
Citrix confirms two NetScaler RCE zero-days exploited in attacks
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation — patch NetScaler to Citrix’s latest fixed builds immediately; if patching cannot be completed within hours, follow Citrix’s guidance to shut down exposed appliances until patched.
- SOC/IR — Act: Active exploitation of NetScaler edge devices means assume compromise is possible before patching — hunt for anomalous outbound connections, unexpected processes, or lateral movement originating from NetScaler appliances since the disclosure date, and tune detections for post-RCE behavior on these hosts.
- Leader — Act: Dual CISA KEV-listed RCEs on widely deployed enterprise edge infrastructure warrant same-week leadership action — confirm whether your environment runs NetScaler, verify engineering has begun emergency patching, and prepare to brief leadership given the likelihood of board or customer questions.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.