By BigGo Finance
Publication Date: 2026-09-28 06:05:00
Citrix disclosed on September 27, 2026, that eight vulnerabilities have been discovered in its NetScaler ADC and NetScaler Gateway network appliances, revealing that two of them are already being actively exploited in real-world attacks. Both exploited vulnerabilities carry a CVSS v4.0 severity score of 9.5 out of 10—an extremely critical rating—and one allows unauthenticated attackers to execute arbitrary commands even on default configurations. Cloud Software Group, the parent company of Citrix, is strongly urging affected customers to update to patched versions immediately.
Two Confirmed Exploited Vulnerabilities
The two vulnerabilities being exploited in attacks are CVE-2026-88771 and CVE-2026-88772. CVE-2026-88771 stems from insufficient input validation, allowing unauthenticated attackers to execute arbitrary commands. Critically, all default deployment environments are affected, even without any special features enabled.
CVE-2026-88772 is a memory overflow vulnerability…