Overview
- Citrix published fixes for eight NetScaler flaws, including the two actively exploited zero‑days tracked as CVE‑2026‑88771 and CVE‑2026‑88772, in updates released on Sunday and urged customers to install them immediately.
- CVE‑2026‑88771 is an unauthenticated input‑validation remote‑code‑execution flaw that affects default NetScaler ADC and Gateway deployments, and CVE‑2026‑88772 is a memory‑overflow flaw that permits RCE or denial of service when DTLS is enabled.
- The U.S. Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to remediate vulnerable appliances by September 30.
- Citrix made generic indicators of compromise available through NetScaler Console but warned those scans can miss intrusions and advised preserving memory, logs and other forensic evidence before or during patching.
- Researchers say exploitation escalated from targeted intrusions into broad opportunistic scanning after proof‑of‑concept material appeared, and tens of thousands of internet‑exposed NetScaler instances mean organizations should assume they may be probed or already compromised.