Citrix says two NetScaler zero-days are under attack and releases fixes
SecurityUnverifiedUpdated:
Citrix reportedly confirmed exploitation of two NetScaler zero-days and released fixes. They concern remote code execution, and the reported claims have not been independently verified.
Two zero-days and their configuration conditions
According to BleepingComputer, Citrix said CVE-2026-88771 and CVE-2026-88772 have been exploited as zero-days against NetScaler devices. The report says Citrix released security updates for affected customer-managed NetScaler ADC and NetScaler Gateway appliances. It describes both flaws as having severity scores of 9.5; CVE-2026-88771 affects deployments including default configurations, while CVE-2026-88772 can be exploited when DTLS is enabled.
The report does not provide a comparable before-to-now count of affected devices or attacks.
BleepingComputer reports that Citrix has published bulletin CTX697096, released updates, and confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments.
The report describes NetScaler appliances as internet-facing devices used for remote access and application delivery. It says compromising one can potentially give an attacker an initial foothold at a network perimeter and a route toward internal systems.
Sources
- BleepingComputerCitrix confirms two NetScaler RCE zero-days exploited in attacksRead source →