CERT24Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway AppliancesLoading data…
CERT24Threat Observatory
Period

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

In late September 2026, Mandiant Consulting and the Google Threat Intelligence Group identified active, in-the-wild exploitation of zero-day vulnerability CVE-2026-88772 affecting Citrix NetScaler ADC and NetScaler Gateway appliances. According to the source, the campaign had been ongoing since at least early September 2026, and organizations in North America and Europe may have been impacted. Vendor disclosures also state that CVE-2026-88771 was being actively exploited.

← Back to intelligence

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

In late September 2026, Mandiant Consulting and the Google Threat Intelligence Group identified active, in-the-wild exploitation of zero-day vulnerability CVE-2026-88772 affecting Citrix NetScaler ADC and NetScaler Gateway appliances. According to the source, the campaign had been ongoing since at least early September 2026, and organizations in North America and Europe may have been impacted. Vendor disclosures also state that CVE-2026-88771 was being actively exploited.