Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix has confirmed two critical remote code execution zero-day vulnerabilities in NetScaler, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in attacks. The company has released security updates to address both flaws. Administrators are urged to apply patches immediately or shut down vulnerable NetScaler instances to prevent compromise. The vulnerabilities are classified as critical severity, indicating they can be exploited without authentication or with minimal user interaction. Active exploitation in the wild significantly raises the risk for organizations running unpatched NetScaler deployments. NetScaler is widely used for application delivery and VPN access in enterprise environments, making it a high-value target for threat actors. Citrix has advised immediate remediation steps to protect affected systems.