Two critical Citrix NetScaler zero-days exploited before patches became available

Citrix has confirmed the active exploitation of two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, identified as CVE-2026-88771 and CVE-2026-88772. The flaws allow remote code execution and could therefore enable attackers to take control of exposed appliances. The first reports came from administrators and security companies, which advised some customers to disconnect their systems while official information and fixes were not yet available. watchTowr linked the vulnerabilities to forensic investigations into breaches that had already occurred, confirming that the attacks had begun before the patches were released. Citrix subsequently released updates for eight vulnerabilities in total, three critical and five rated high severity; the new flaws are unrelated to CVE-2026-19490 and CVE-2026-19489, which were disclosed in August. Organizations must update immediately, check for indicators of compromise, and consider temporarily isolating appliances that cannot be patched.

Source: ACN — CSIRT Italy