Act
archived
NetScaler Zero-Days CVE-2026-88771 & CVE-2026-88772 Actively Exploited
- Engineer — Act: Both CVEs are CISA KEV listed with public PoCs and confirmed in-the-wild exploitation on NetScaler (Citrix ADC/Gateway) appliances — patch to Citrix’s remediated version immediately and audit device logs for signs of pre-patch compromise.
- SOC/IR — Act: Active zero-day exploitation of NetScaler edge appliances warrants an assume-breach posture — sweep for IOCs published in the Unit 42 brief, hunt for lateral movement or credential harvesting originating from NetScaler hosts since these may have been exploited before disclosure.
- Leader — Act: NetScaler is widely deployed across enterprise networks; dual CISA KEV-listed zero-days with active exploitation is board-question-level risk — confirm whether your org runs NetScaler, verify emergency patching is underway, and prepare to brief leadership if exposure is confirmed.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.