Critical Citrix NetScaler Zero-Days Exploited: CVE-2026-88771 & CVE-2026-88772 Analysis
In September 2026, Citrix confirmed that two critical NetScaler remote code execution zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) were being actively exploited in attacks. Both vulnerabilities carry a severity score of 9.5, with CVE-2026-88771 affecting all NetScaler ADC and Gateway deployments through improper input validation, and CVE-2026-88772 exploiting memory overflow when DTLS is enabled. The attacks prompted emergency warnings from national cybersecurity agencies and IT suppliers, with organizations advised to immediately shut down NetScaler appliances before patches became available. These edge devices are particularly valuable targets as they provide attackers initial network perimeter access without first compromising internal endpoints. This incident highlights the continuing evolution of zero-day exploitation targeting critical infrastructure components, particularly as threat actors increasingly focus on edge appliances and VPN gateways. The coordinated response from multiple national CERTs and the invocation of the EU Cyber Resilience Act demonstrates the growing regulatory and security community emphasis on rapid threat intelligence sharing.
Kill Chain
