CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero-Days Exploited in the Wild

Citrix released emergency fixes for two critical NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772; CVSS v4.0 9.5) that allow unauthenticated remote code execution on internet-facing ADC/Gateway appliances and are being actively exploited; CVE-2026-88771 is an improper input validation flaw affecting default configurations, while CVE-2026-88772 is a DTLS-related memory overflow (DTLS enabled by default on VPN vservers). The advisory lists affected builds, urges immediate upgrade to fixed releases, recommends forensic triage (isolate, preserve evidence, rebuild, rotate keys/credentials), and warns that vendor scan results and the lack of public IOCs do not guarantee systems are uncompromised.