Citrix confirmed on September 27 that two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, are under active exploitation. Patches are out for both. CISA moved the same day, amplifying disclosure of eight additional NetScaler vulnerabilities on top of the two already burning.

NetScaler sits at the network edge of most APAC banks running remote access or load balancing for core banking. That is the appliance class that does not get a maintenance window; it gets an incident.

The math here is not favourable. Two zero days confirmed exploited, patched same day, and eight more disclosed in parallel means the advisory a security team reads on Monday morning already has ten line items before anyone has finished patching the first two. CISA amplifying a vendor's own disclosure is not routine. It is what happens when the vendor's timeline and the exploitation timeline are running close enough together that a second warning seems necessary.

The control that matters here is not "patch fast." It is knowing which NetScaler appliances are internet-facing before CISA tells you, because the alert assumes you already have that inventory and the last two years of Citrix edge-device incidents suggest most shops do not.