By Lawrence Abrams
Publication Date: 2026-09-27 16:02:00
Update: Article rewritten with official confirmation from Citrix.
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws.
The vulnerabilities are the same zero-days that cybersecurity researchers, IT providers, and national cybersecurity agencies began privately warning organizations about over the weekend.
NetScaler appliances are particularly valuable targets because organizations commonly deploy them as Internet-facing edge devices that provide remote access and application delivery services for internal corporate networks.
Compromising one of these devices can give attackers an initial foothold at the perimeter of a victim’s network and potentially provide a path to internal systems without first compromising an endpoint inside the organization.
The first signs of the incident appeared when Citrix…
