Member-only story
Patching the Zero-Day Is Not the Same as Removing the Attacker
A critical vulnerability appears on Friday night. Security teams scramble, executives ask whether the organization is affected, vendors publish emergency guidance, and administrators begin pushing patches as quickly as change-control procedures will tolerate. Once the vulnerable systems show the new version number, everyone feels a little better. That reaction is understandable, but it can also be dangerously premature. When a vulnerability was already being exploited before the fix became available, patching closes the door; it does not tell you whether someone walked through it yesterday.
That distinction became painfully relevant this weekend. On September 27, 2026, Citrix disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway, CVE-2026–88771 and CVE-2026–88772, and confirmed exploitation against unmitigated systems. Both carry CVSS v4.0 scores of 9.5. CVE-2026–88771 can allow an unauthenticated attacker to execute commands against affected appliances, while CVE-2026–88772 can permit remote code execution or denial of service when DTLS is enabled. The U.S. Cybersecurity and Infrastructure Security Agency added both vulnerabilities to its Known Exploited Vulnerabilities catalog, with federal remediation required by September 30. BleepingComputer
