NetScaler zero-days: check for compromise before you patch

CISA said on 27 September that threat actors were actively exploiting two critical Citrix NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, globally. It encouraged operators, if possible, to check for compromise before patching and to preserve forensic evidence first. Both carry a CVSS v4.0 base score of 9.5, per Unit 42, which counted 50,277 exposed, potentially vulnerable instances as of 27 September. On 4 October CISA added a third flaw, CVE-2026-88779, to its Known Exploited Vulnerabilities catalog.

Exploitation began weeks earlier. Google Threat Intelligence Group and Mandiant traced CVE-2026-88772 exploitation to early September by suspected state-linked actors, and Mandiant's Charles Carmakal said dozens of organizations were affected, per Cybersecurity Dive. The third flaw may be narrower: a security research firm told SecurityWeek it reproduced CVE-2026-88779 and found it can only be used to crash systems, although SecurityWeek also reported that appliances already updated for the first two flaws kept rebooting.

1. 21 AugUnit 42 sees NetScaler fingerprinting begin from two hosts; the same requests later reach more than 100 other systems.
2. 4 SepUnit 42 observes CVE-2026-88772 exploitation on DTLS configurations, running to 24 September; it sees CVE-2026-88771 exploited on 21 September.
3. 27 SepCitrix discloses eight NetScaler CVEs; CISA adds CVE-2026-88771 and CVE-2026-88772 to KEV, per CISA.
4. 4 OctCISA adds CVE-2026-88779 to KEV with a 7 October federal deadline, per SecurityWeek.

Remote-access, mail and management appliances usually sit outside endpoint detection. On 1 October, BleepingComputer reported that CISA required federal agencies to perform forensic triage on an exploited FortiMail flaw and mitigate it by 4 October. Microsoft's 2026 Digital Defense Report puts the median time from discovery in the wild to weaponization well below 24 hours, while enterprise remediation of critical external vulnerabilities can take 30 to 60 days. Patching does not remove existing persistence, Unit 42 notes; Carmakal said the threat actor deployed web shells and moved laterally at some targets.

• Isolate vulnerable appliances and preserve snapshots, logs and technical support bundles before updating, per Unit 42.
• Hunt for web shells, suspicious sessions, logging gaps and lateral movement.
• Rotate credentials that passed through the appliance during the exposure window.
• Keep a live inventory of internet-facing appliances, including suppliers', and check each KEV addition against it.

STRATUM — Cyber Threat is designed to support the organization's own side of that last step: continuous mapping of its internet-facing footprint, including unknown assets, with exposure prioritized by mission impact, not raw CVE count. It is not a SIEM replacement or a vulnerability scanner; it works alongside the vulnerability stack already in place. When a KEV addition lands, analysts start from a short, mission-ranked exposure list, and they decide what to isolate, assess and patch, and in what order.

This extends the SharePoint lesson that exposure, not patching, is the measure that matters. NetScaler adds the order of operations. When exploitation runs about three weeks ahead of the bulletin, the first question after an advisory is whether the appliance was already compromised.