Executive Summary
Citrix has confirmed the active exploitation of two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway prior to the availability of patches. While Citrix has not explicitly attributed these specific attacks to a single actor, the broader threat landscape includes reports of North Korea-linked hackers targeting cryptocurrency exchanges and groups like ShinyHunters claiming breaches via other zero-day vectors.
The technical focus is on CVE-2026-88771, an improper input validation flaw affecting all deployments, and CVE-2026-88772, a memory overflow vulnerability affecting systems with DTLS enabled. These flaws allow unauthenticated attackers to execute arbitrary commands or inject shellcode directly into memory, potentially granting full control over the appliance.
NetScaler appliances serve as critical network edge points for VPN, load balancing, and authentication. Compromise of these systems provides a high-value foothold for persistent access and lateral movement. Citrix urges immediate patching to version 14.1-73.37 or 13.1-64.23 and later, as previous August 2026 updates do not mitigate these new threats.