An emergency with two responsibilities
CISA warned September 27 that attackers are exploiting critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway. The agency identified eight newly disclosed flaws and added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog. Either of those two vulnerabilities can independently enable remote code execution, according to the alert. The warning makes this an active incident-response concern for affected operators, rather than a vulnerability to leave in an ordinary maintenance queue.
Preserve evidence while arranging remediation
The agency cautions that updates can require downtime and can remove evidence useful to investigators. Where possible, organizations should check for indicators before patching and preserve forensic evidence when compromise is suspected. CISA points administrators to Citrix guidance and indicators available through NetScaler Console. Administrators should use the current vendor bulletin to identify affected deployments and the applicable update path; a generic version recommendation would be inadequate for a varied appliance estate.
Give the business a clear decision
For a healthcare organization, the emergency plan should identify which clinical or administrative services depend on the appliance and who can authorize an interruption. Government and defense organizations should similarly bring system owners into the response early. Those are continuity considerations, not claims that either sector has been compromised. A useful change record connects each appliance to an owner, exposure assessment, evidence-preservation decision and remediation status.
A completed update is one checkpoint
Our operational recommendation is to keep remediation and investigation as separate work items. Record what was checked before the change, what could not be preserved, and who is reviewing possible earlier access. If an MSP manages the appliance, the customer should receive that record along with the change result. Closing a patch ticket should not silently close an unresolved compromise investigation. Emergency action needs speed, but it also needs an accountable handoff.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
