Our takeCitrix patched CVE-2026-88772 (CVSS 9.5) in NetScaler ADC/Gateway after it was exploited in the wild since early September, including by suspected state actors. If you run these appliances, patch immediately and check logs for compromise.Cyber Resilience desk
Sources (5)
- hackernews · hackernews
- helpnet · helpnet
- securityweek · securityweek
- acsm_au · acsm_au
- hackernews · hackernews
What this means for you — Security leader:Apply the Citrix NetScaler patches for CVE-2026-88772 immediately; the flaw enables pre-auth remote code execution and is under active exploitation by suspected state actors targeting government and finance organizations.
What this means for you — Lean IT orgs:If you run Citrix NetScaler ADC or Gateway, update to a fixed build right now — attackers are actively exploiting this flaw to run code without logging in.
What this means for you — MSP:Check every client running NetScaler ADC/Gateway and deploy the CVE-2026-88772 patches as priority zero; dozens of organizations have already been hit in targeted campaigns.
What this means for you — Researcher:Review the public exploit details for CVE-2026-88772; it provides a pre-auth path to shellcode execution via a DTLS memory overflow and is confirmed under active exploitation.