Emergency Alert: Two Critical Citrix NetScaler Zero-Days Exploited

Your Citrix gateway might already be compromised. If you manage perimeter security or work in a SOC, you've got to pay attention to what's happening across enterprise networks right now. Active, unauthenticated remote code execution attacks are tearing through edge appliances before teams even realize they've been breached. Two zero-day vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in the wild. Attackers are chaining these flaws to bypass edge controls on Citrix NetScaler ADC and Citrix Gateway instances. These attacks need zero authentication, zero user interaction, and zero valid credentials. The exploits land directly on internet-facing management and gateway endpoints, running root-level payloads and setting up stealthy persistence beneath standard gateway telemetry. If your appliance is exposed to the public internet, you can't wait for your regular maintenance cycle. Here are the three immediate triage and response steps you've got to execute right now. First, run NetScaler ADC vulnerability detection and hunt for active indicators of compromise. Connect to your appliance shell and inspect the core log files under var log ns dot log. Search specifically for anomalous child processes spawned by the core packet engine, unusual cron jobs dropped in flash nsconfig, and unauthorized web shells placed in the netscaler ns gui vpn directories. If you see unauthenticated HTTP POST requests triggering segmentation faults in the crash directory, treat that appliance as actively compromised. Second, apply immediate perimeter containment to cut off the exploit path. Restrict all NetScaler management interfaces, including NSIP and CLIP addresses, strictly to dedicated internal management subnets. If you can't patch immediately, enforce strict web application firewall filtering rules in front of your gateway virtual IPs to drop malformed header structures targeting the authentication handler. Temporarily revoke stale session tokens and cut off direct LDAP communication from suspect appliances to your domain controllers. Third, deploy the emergency CVE-2026-88771 patch and run a thorough forensic validation. Pull the official vendor build, verify the cryptographic checksums, and perform a staged high-availability failover upgrade across your secondary and primary nodes. Remember, applying the patch alone won't evict an attacker who's already established a foothold—and let's be honest, that's usually where teams get burned. After updating the firmware, perform a clean reboot, compare your configuration files against known-good baselines, and rotate all certificates and stored service account credentials. Don't assume your monitoring tools have caught this. Run your indicator of compromise queries immediately, verify your firmware versions, and deploy the emergency patches today. Share this brief with your network engineering and SOC teams right away so you can secure your perimeter before attackers escalate an edge foothold into total domain compromise.