Citrix: 2 Actively-Exploited Flaws Added to CISA KEV

Key findings

• Two Citrix vulnerabilities, CVE-2026-88771 and CVE-2026-88772, added to CISA KEV.
• Both flaws are confirmed to be under active exploitation by threat actors.
• Immediate patching and mitigation are critical for all organizations using affected Citrix products.
• CISA's KEV listing mandates rapid remediation for federal agencies.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert by including two critical Citrix vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in its Known Exploited Vulnerabilities (KEV) Catalog. This addition signifies that these flaws are under active exploitation by malicious actors in the wild, making them a significant and immediate risk to any organization utilizing affected Citrix products. The KEV catalog serves as a definitive list of vulnerabilities that federal civilian executive branch (FCEB) agencies are required to remediate within specific deadlines, but its implications extend to all organizations, highlighting vulnerabilities that are actively being leveraged in attacks.

The two vulnerabilities are:

• **CVE-2026-88771**: This vulnerability, while specific details are pending public disclosure, has been confirmed by CISA as actively exploited, indicating a high potential for unauthorized access or system compromise.
• **CVE-2026-88772**: Similar to its counterpart, CVE-2026-88772 is also under active exploitation, posing a critical risk to the confidentiality, integrity, and availability of systems.

The inclusion of these vulnerabilities in the KEV catalog mandates that federal agencies address them by a specific due date, typically within two weeks of their listing. For all other organizations, this serves as a critical warning to prioritize patching and mitigation efforts immediately. Active exploitation means that threat actors are already leveraging these weaknesses to gain footholds in networks, deploy malware, or exfiltrate data. Organizations should not delay in identifying all affected Citrix assets and applying the necessary security updates or workarounds provided by the vendor.

Defenders are strongly advised to review their environments for any instances of affected Citrix products. Immediate action should include applying all available patches, monitoring network traffic for indicators of compromise related to these CVEs, and implementing robust segmentation to limit potential lateral movement if an exploit is successful. Proactive vulnerability management, coupled with a swift response to CISA's KEV alerts, is essential to protect against the most pressing cyber threats.

This Rapid7 analysis provides crucial technical details on the two critical zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway, CVE-2026-88771 and CVE-2026-88772. It highlights that CVE-2026-88771 is particularly dangerous due to its low attack complexity and exploitable nature in default configurations, while CVE-2026-88772 requires the DTLS feature to be enabled. The article also confirms that both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to widespread global exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two critical Citrix NetScaler ADC and Gateway vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, rated with CVSS scores of 9.5 and 9.4 respectively, are confirmed to be under active global exploitation by threat actors. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies must apply fixes by September 30, 2026, due to the complexity of updating these appliances and the potential for downtime.

This new analysis from watchTowr Labs delves into CVE-2026-88771, a critical pre-authentication command injection vulnerability affecting Citrix NetScaler. The researchers detail how improper input validation allows unauthenticated attackers to execute arbitrary commands, noting that the vulnerability was exploited in the wild as a zero-day before a fix was available. The report also provides a comparative analysis of the vulnerable and patched versions, highlighting specific code changes in a Perl script that address the flaw.

This new analysis from watchTowr Labs provides a deep dive into CVE-2026-88772, a critical DTLS pre-authentication memory overflow vulnerability affecting Citrix NetScaler ADC and Gateway. The research details how the vulnerability is triggered by malformed DTLS records during packet reassembly, leading to potential remote code execution or denial of service, and confirms its exploitation in the wild as a zero-day.

Researchers have now detailed the technical mechanism behind CVE-2026-88772, a critical memory overflow vulnerability in Citrix NetScaler ADC and Gateway. The exploit leverages inconsistencies in DTLS protocol handling, allowing an attacker to craft malicious records that trigger an overflow, ultimately leading to shellcode execution with root privileges by manipulating the mprotect() system call to bypass NX protections.

This new reporting details the specific post-exploitation tools, WHIPSHOT and SLAPSHOT, deployed by threat actors after exploiting CVE-2026-88772. It further elaborates on the attack chain, including how web shells are disguised as .deb and .sig files and how persistence is achieved by modifying permissions for '/bin/sh' and rebooting the appliance. The analysis also highlights the use of DTLS protocol flaws for initial root access and the proxying capabilities of SLAPSHOT for internal reconnaissance and credential theft.

CISA has added CVE-2026-88779, a vulnerability affecting Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog. This specific flaw involves improper restriction of operations within the bounds of a memory buffer and is identified as a known attack vector. Federal agencies are mandated by Binding Operational Directive 26-04 to prioritize patching this vulnerability on exposed assets.