Two Citrix NetScaler Zero-Days Exploited Globally

Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-88771 and CVE-2026-88772, both with a CVSS score of 9.5 and already exploited as zero-days. The first allows an unauthenticated remote attacker to execute commands on devices using default configurations, while the second can cause code execution or denial of service on systems with DTLS enabled. Attackers reportedly exploited the flaws for weeks, installing web shells and establishing persistence on compromised appliances. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, while U.S., British, and Dutch authorities have issued urgent advisories. Because NetScaler is often exposed to the Internet and serves as a remote access point to corporate networks, a compromise may enable further intrusions and credential theft. Organizations must immediately install the patched builds and inspect devices for web shells, anomalous changes, and indicators of access occurring before the patch was applied.

Source: Help Net Security