Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix has officially confirmed that two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, identified as CVE-2026-88771 and CVE-2026-88772, were actively exploited as zero-days before patches became available. Both issues carry a severity rating of 9.5: the first lets unauthenticated attackers run arbitrary commands due to flawed input validation on any default setup, while the second is a memory overflow triggered when DTLS is active, which is the default on VPN virtual servers, potentially enabling code execution or denial of service. The alert followed days of informal warnings from IT suppliers, CERTs, and the Dutch NCSC urging admins to power down their appliances even before Citrix published details or CVE numbers. Vulnerable builds include NetScaler ADC/Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus related FIPS/NDcPP and Secure Private Access Hybrid deployments, and Citrix recommends installing the released fixes immediately or limiting internet exposure until updates can be applied.