Exploitation of New Citrix NetScaler Zero-Days Becomes Widespread

Two serious vulnerabilities in Citrix NetScaler ADC and Gateway products are creating an emergency for organizations that expose these devices to the Internet. CVE-2026-88771, which can be exploited remotely in vulnerable default configurations, was reportedly used covertly for at least three weeks before being detected. Following the publication of a technical analysis and proof of concept, the attacks shifted from targeted operations to large-scale indiscriminate campaigns. Researchers also described CVE-2026-88772, a pre-authentication memory overflow related to DTLS, heightening concerns over the simultaneous presence of two critical flaws on the same perimeter. NetScaler handles VPNs, TLS termination, and remote access, so a compromise can provide attackers with a privileged entry point into internal networks. Organizations must immediately update affected devices, check for any indicators of compromise, and not consider patching alone sufficient if the systems remained exposed.

Source: Help Net Security