Warning: Two Unpatched Citrix Net Scaler RCE Zero-Days Under Active Exploitation
Summary: Citrix confirmed on September 27 that two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild, and released fixes for them along with six other flaws. One of the two affects every deployment on an affected version, including default configurations, and the bulletin lists no workaround and no indicators of compromise.
What you should know: Both flaws were attacked before Citrix published any notice, so installing the update will not show whether an attacker got in first - the same gap the Dutch National Cyber Security Centre flagged in 2025, when it said patching alone did not remove risk because an attacker could keep access gained beforehand.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-19490CVE-2026-88771CVE-2026-88772
- Related
- Threat Brief: Net Scaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) Cyber Risks ·Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026