Citrix NetScaler Zero-Days Join CISA KEV as AI Tools Targeted

What happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) catalog. Both carry CVSS scores of 9.5. 1 A KEV listing means CISA has evidence of active exploitation. It also triggers remediation deadlines for U.S. federal civilian agencies and acts as a strong signal for private-sector defenders to patch.

Reporting on the NetScaler situation is not fully consistent. Separate coverage centers on a different identifier, CVE-2026-88779, described as a SAML-related zero-day. According to that coverage, Citrix had to issue emergency patches after attackers crashed appliances that had already been updated. 2 The public record does not make clear whether CVE-2026-88779 is a sibling flaw, a follow-on bypass, or part of the same disclosure cluster as the two catalogued CVEs.

Defenders should not assume one patch covers every NetScaler issue now in circulation. The safer approach is to check each CVE individually against Citrix's advisories.

Why NetScaler keeps showing up

NetScaler appliances sit at the network edge. They handle remote access, load balancing and authentication for large organizations, which makes them high-value targets. A flaw in the SAML path is especially sensitive because SAML brokers single sign-on trust between identity providers and applications.

One detail stands out: freshly patched appliances were reportedly still being crashed. 2 That suggests the initial fixes may not have fully closed the attack surface. In practice, it means:

• Applying the latest update may not be the end of the job.
• Teams should watch for further advisories.
• Teams should hunt for signs of compromise that may predate patching.

With CVSS scores of 9.5 on the catalogued flaws, NetScaler owners have little room for delay. 1

The bigger shift: AI infrastructure in the KEV catalog

The more consequential story may be what is appearing in the KEV catalog next to the NetScaler entries. CISA has been steadily adding AI development and orchestration tools to the list, alongside the familiar firewalls and VPN gear. 2

The reported timeline:

• July: Langflow became the first AI agent platform added to KEV. Its listing was tied to a campaign dubbed JADEPUFFER, described as autonomous ransomware that harvested API keys for Anthropic, OpenAI and cloud services. 2
• September: LiteLLM, Kestra and other AI-proxy components were added, together with flaws in SonicWall and JFrog products. 2 In the LiteLLM case, Qilin ransomware operators reportedly pulled model-provider keys directly out of a LiteLLM proxy's database. 2

The pattern is that the tools organizations use to route requests to large language models, or to coordinate AI agents, often hold a concentrated set of secrets. An LLM gateway may store keys for several model providers and cloud accounts in one place. Breaching it can hand an attacker:

• the ability to run up compute costs,
• access to sensitive prompts and data,
• a foothold for moving further into cloud environments.

Reading the signal

Placing NetScaler zero-days and AI proxies in the same catalog shows that attackers do not treat these as separate categories. Both are infrastructure that brokers access, and both are being mined for credentials. Coverage of the trend describes the AI control plane (LLM gateways and agent orchestrators) as a credential vault that attackers now pursue as aggressively as traditional edge appliances. 2

For security teams, the practical takeaway is that AI tooling needs the same governance already applied to VPN concentrators. Many organizations adopted Langflow-style builders or LiteLLM-style proxies quickly, often through developer or data science teams rather than central IT. Those deployments may lack:

• consistent patching,
• network segmentation,
• secret rotation.

An attacker who extracts provider keys from a proxy database exploits exactly that gap.

What to do now

For NetScaler:

• Confirm exposure to CVE-2026-88771 and CVE-2026-88772 and patch promptly given their KEV status. 1
• Track CVE-2026-88779 separately, since reports indicate early patches did not stop attackers from crashing appliances. 2

For AI infrastructure:

• Inventory every LLM gateway and agent orchestration platform in use.
• Keep them updated.
• Restrict network access to them.
• Rotate any model-provider and cloud keys they store, especially where the software matches products already in the KEV catalog. 2

Bottom line

The NetScaler entries are urgent, but they follow a familiar pattern. The newer development is that AI orchestration tools now draw the same level of attacker interest as edge appliances. Organizations should treat both as part of the same perimeter.