CISA has added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog, putting another urgent patch window in front of hosting providers, managed service firms, and site operators that expose NetScaler ADC or NetScaler Gateway at the network edge.

The agency listed CVE-2026-88771 and CVE-2026-88772 on September 27 and set a September 30 remediation deadline for U.S. federal civilian agencies. CISA describes CVE-2026-88771 as an improper input validation flaw that can allow an unauthenticated attacker to execute arbitrary commands. CVE-2026-88772 is described as a memory-buffer bounds issue that can lead to remote code execution or denial of service.

The warning is especially relevant for hosting environments because NetScaler appliances often sit in front of customer portals, control panels, VPN access, application delivery stacks, and high-traffic web properties. A compromise at that layer can affect more than one application, and a denial-of-service condition can quickly become a customer-facing availability incident.

Citrix’s linked bulletin covers the broader CVE-2026-88771 through CVE-2026-88778 NetScaler advisory. CISA also points administrators to Citrix guidance for suspected compromise and says organizations should run the vendor-provided indicators of compromise, perform forensic triage where required, and apply mitigations or discontinue use if mitigations are unavailable.

For hosting teams, the practical checklist is straightforward: inventory internet-facing NetScaler ADC and Gateway deployments, confirm the fixed or mitigated build level, preserve logs before rebooting or rebuilding, check Citrix’s IOCs, and review whether customer-facing services depend on the same edge appliances for load balancing, SSL termination, WAF, or remote access.

Source: CISA Known Exploited Vulnerabilities catalog; related coverage: BleepingComputer.