Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Reported exploitedNetScaler ADCNetScaler GatewayOur summary
Unit 42 has confirmed that attackers are actively exploiting two previously unknown flaws in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS v4.0 score of 9.5. The first lets an unauthenticated attacker execute arbitrary commands due to insufficient input validation, while the second is a memory overflow in the DTLS configuration that can trigger remote code execution or denial of service. Citrix disclosed the in-the-wild abuse, and Palo Alto Networks' Cortex Xpanse telemetry has already spotted more than 50,277 internet-facing instances that could be vulnerable as of September 27, 2026. Organizations are urged to check exposure against Citrix's advisory, isolate affected appliances, preserve forensic evidence, hunt for suspicious admin sessions or logging gaps, and apply the latest patches immediately, keeping in mind that patching alone won't evict attackers who already gained persistent access.
Below is the opening; the full story is at Palo Alto Unit 42.
From Palo Alto Unit 42
Executive Summary
Unit 42 is aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. No further details are currently available about the exploit activity.
- CVE-2026-88771 is a remote code execution (RCE) vulnerability that fails to properly validate input and allows an unauthenticated actor to run commands against NetScaler ADC and NetScaler Gateway systems
- CVE-2026-88772 is a memory overflow vulnerability that can lead to a remote code execution (RCE) or denial of service (DoS) on the Datagram Transport Layer Security (DTLS) configuration on NetScaler ADC and NetScaler Gateway systems…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.