Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

Unit 42 has identified active zero-day exploitation targeting NetScaler devices, attributed to two vulnerabilities reported by Citrix: CVE-2026-88771 and CVE-2026-88772. Both vulnerabilities have been confirmed as exploited in the wild. The threat brief was published by Palo Alto Networks' Unit 42 threat intelligence team. NetScaler (formerly Citrix ADC/Gateway) is a widely deployed network infrastructure product, making this a high-severity concern for enterprise environments. Organizations using NetScaler devices are advised to monitor for indicators of compromise and apply any available patches or mitigations immediately. The active exploitation status elevates the urgency for defenders to respond quickly.