Nothing says "urgent" quite like a federal cybersecurity agency working the weekend. CISA spent its Saturday and Sunday telling U.S. agencies to drop what they're doing and patch Citrix NetScaler — because somewhere out there, attackers were already inside.
Eight Flaws, Two Actively Under Fire
On September 27, CISA issued an alert covering eight newly disclosed vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 through CVE-2026-88778. Two of them — CVE-2026-88771 and CVE-2026-88772 — earned an immediate spot on CISA's Known Exploited Vulnerabilities catalog, meaning these aren't theoretical bugs sitting in a lab report. CISA says threat actors are actively exploiting them globally, right now, with both capable of enabling remote code execution entirely on their own.
NetScaler devices sit at the edge of corporate networks, handling load balancing and remote access for everything from banks to government agencies — which is exactly why attackers love them. Compromise the gateway, and you've compromised the front door to everything behind it.
Patch Fast, But Look Before You Leap
Here's the twist that makes this alert more interesting than your average "patch now" memo: CISA is explicitly telling organizations to check for signs of compromise before applying the fix, because patching can wipe out the forensic evidence of whether you were already breached. That's a genuinely uncomfortable position to be in — fix the hole, but maybe photograph the crime scene first.
For federal civilian agencies, the clock is running under Binding Operational Directive 26-04, with a patch deadline of September 30. Everyone else doesn't get a federal deadline, but attackers don't check your org chart before they start knocking.
When "patch it" and "preserve the evidence" are competing priorities, you're not having a good week — but at least you know about it, which is more than some NetScaler admins can say right now.
If you're not sure whether your infrastructure has a plan for exactly this kind of race-against-the-clock patching, our free security checklist for developers is a solid place to start closing the gap.
Source: CISA