Act
archived
Citrix NetScaler CVE-2026-88772 Pre-Auth RCE Actively Exploited
- Engineer — Act: CISA KEV-listed pre-auth memory overflow in NetScaler ADC/Gateway (CVSS 9.5) with public PoC and confirmed active exploitation — patch all NetScaler ADC and Gateway appliances to the vendor-fixed version immediately, prioritizing internet-facing instances.
- SOC/IR — Act: Active exploitation of a pre-auth edge-device RCE means assume-breach posture is warranted — sweep NetScaler ADC/Gateway logs for anomalous DTLS traffic, unexpected shell processes, or lateral movement originating from the appliance since initial disclosure date.
- Leader — Act: Citrix NetScaler is pervasive in enterprise environments and this actively exploited critical RCE is CISA KEV-listed — confirm whether NetScaler ADC/Gateway is deployed, direct immediate patching, and brief leadership if it is internet-facing or handles sensitive authentication flows.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.