# Citrix NetScaler vulnerabilities & exploitation

**CISA KEV**

> As of 2026-10-05, Threadlinqs tracks 8 Citrix NetScaler CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 2 tracked threat campaigns.

**Data as of:** 2026-10-05

## Exploitation timeline

Threadlinqs has recorded 8 Citrix NetScaler CVEs published between 2026-09-15 and 2026-09-15. The busiest month was 2026-09 (8 new CVEs). 1 of them (13%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 8 of 8 tracked Citrix NetScaler CVEs.

- [CVE-2026-88772](https://intel.threadlinqs.com/cve/CVE-2026-88772) — CRITICAL 9.5 · KEV · 2026-09-27
- [CVE-2026-88771](https://intel.threadlinqs.com/cve/CVE-2026-88771) — CRITICAL 9.5 · 2026-09-27
- [CVE-2026-88773](https://intel.threadlinqs.com/cve/CVE-2026-88773) — CRITICAL 9.3 · 2026-09-27
- [CVE-2026-88775](https://intel.threadlinqs.com/cve/CVE-2026-88775) — HIGH 8.8 · 2026-09-27
- [CVE-2026-88776](https://intel.threadlinqs.com/cve/CVE-2026-88776) — HIGH 8.8 · 2026-09-27
- [CVE-2026-88777](https://intel.threadlinqs.com/cve/CVE-2026-88777) — HIGH 8.8 · 2026-09-27
- [CVE-2026-88778](https://intel.threadlinqs.com/cve/CVE-2026-88778) — HIGH 8.8 · 2026-09-27
- [CVE-2026-88774](https://intel.threadlinqs.com/cve/CVE-2026-88774) — HIGH 7 · 2026-09-27

## Products affected

Threadlinqs normalises CPE and CNA product records across all 8 CVEs; 2 distinct Citrix NetScaler products are affected. The most frequently affected:

- ADC — 8 CVEs
- Gateway — 8 CVEs

## Threat activity

2 tracked threat campaigns reference Citrix NetScaler products or exploit Citrix NetScaler CVEs:

- [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — CRITICAL — 2026-09-27
- [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — CRITICAL — 2026-09-27

## How to prioritise Citrix NetScaler patching

This order follows the data Threadlinqs holds for Citrix NetScaler, not a generic severity checklist:

- 1 of 8 Citrix NetScaler CVEs (13%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-88772](https://intel.threadlinqs.com/cve/CVE-2026-88772).
- 3 CVEs score Critical and 5 High on CVSS v3 (maximum 9.5, average 8.8); sequence these after KEV and high-EPSS items.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/citrix-netscaler
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp