Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

Citrix has shipped fixes for eight critical and high-severity flaws affecting NetScaler ADC and NetScaler Gateway, and two of them, tracked as CVE-2026-88771 and CVE-2026-88772, were already being abused as zero-days to drop webshells on vulnerable appliances. Researchers say attacks have reportedly been ongoing for weeks across multiple organizations worldwide, with European government agencies privately warning customers before the public disclosure, and experts suspect a well-resourced espionage actor rather than opportunistic intruders. CVE-2026-88771 lets unauthenticated remote attackers run arbitrary commands on default configurations with no user interaction, while CVE-2026-88772 is a memory-overflow bug enabling remote code execution or denial of service when DTLS is active, which is the default state on virtual VPN servers. Impacted versions include NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and the FIPS/NDcPP builds before 14.1-73.37 FIPS and 13.1-37.279; CISA has added both CVEs to its Known Exploited Vulnerabilities list, giving US federal agencies until September 30, 2026 to patch and hunt for intrusion evidence, while Citrix and NCSC-NL urge thorough forensic checks since attackers reportedly erase traces and rotate logs may hide earlier compromise.