Citrix says two worrying NetScaler RCE zero-days exploited in attacks
- Citrix patched two critical zero‑days (CVE‑2026‑88771, CVE‑2026‑88772) in NetScaler ADC/Gateway, both enabling remote code execution
- Exploits already observed; CISA added flaws to KEV catalog with a three‑day patch deadline (Sept 30)
- NetScaler appliances are prime targets due to internet exposure, privileged access, and limited monitoring visibility
Citrix has released a patch for two critical zero-day vulnerabilities apparently being actively exploited in real-life attacks.
In its weekend security advisory, Citrix said it fixed two bugs: CVE-2026-88771 and CVE-2026-88772.
It is now urging organizations to apply the fix as soon as possible and defend their premises from potentially disruptive attacks.
What Citrix fixed
The first issue is an improper input validation vulnerability that allows unauthenticated attackers to execute arbitrary commands remotely. It has a severity score of 9.5/10 (critical). The latter is a buffer overflow/memory-corruption vulnerability in Citrix NetScaler ADC and NetScaler Gateway which could allow attackers to execute malicious code remotely,...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
