Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers

Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, were being actively exploited on unmitigated appliances, finally addressing rumors that had circulated for days. CVE-2026-88771 is an input-validation flaw enabling remote code execution, while CVE-2026-88772 is a memory overflow bug that can also trigger DDoS attacks; both carry a 9.5 CVSS score and hit default configurations of NetScaler ADC and Gateway. Researchers, including watchTowr's Benjamin Harris and GreyNoise, say attacks were underway at least a week before Citrix's advisory, with patch metadata suggesting Citrix knew earlier, and Palo Alto Networks scans found over 50,000 exposed NetScaler instances online. Because exploitation is trivial against default setups, experts recommend organizations unable to immediately patch should consider taking affected NetScaler devices offline.