CISA Says Attackers Are Exploiting Two Critical Citrix Net Scaler Flaws Globally
Summary: CISA added two critical Citrix NetScaler ADC and Gateway flaws, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities catalog on Sunday after reports of active exploitation; the first affects all deployments, while the second requires DTLS to be enabled, which is on by default on VPN virtual servers. watchTowr Labs traced CVE-2026-88771 to a Perl script, ns_monuploadd_err.pl, that builds a shell command from attacker-influenced input, allowing an unauthenticated attacker to reach remote code execution as root via a pre-authentication request to /nf/auth/doAuthentication.do, and Palo Alto Networks Unit 42 counted more than 50,277 publicly exposed instances potentially vulnerable as of September 27, 2026.
Why it matters: More than 50,277 exposed NetScaler instances, an unauthenticated path to root, and confirmed global exploitation put this in the category where patching complexity and downtime are the attacker's advantage, not yours.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-88771CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026