Citrix NetScaler Zero-Day Flaws Exploited in the Wild, Emergency Patch Released
If you run a Citrix NetScaler box on the edge of your network, this weekend was a bad one. On Sunday, September 27, Citrix confirmed that attackers had already been exploiting two critical NetScaler vulnerabilities, before any patch existed. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, both score 9.5 out of 10 on the CVSS v4 severity scale. Either one lets an unauthenticated attacker run code remotely on a vulnerable appliance, with no user interaction needed. Citrix’s bulletin, CTX697096, put it plainly: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” ...