Citrix NetScaler ADC and NetScaler Gateway Remote Code Execution Zero-Days
ID: 1838bc15-362c-54c2-bc6e-b1a8cd632123
STIX ID: report--1838bc15-362c-54c2-bc6e-b1a8cd632123
Feed Name: Kudelski Security
Citrix disclosed two critical unauthenticated RCE vulnerabilities in NetScaler ADC/Gateway (CVE-2026-88771 and CVE-2026-88772) plus six lower-severity flaws; CVE-2026-88771 enables root command execution by injecting attacker-controlled data into a Perl diagnostic script that parses logs and has been actively exploited to deploy persistent PHP web shells, and CVE-2026-88772 is a DTLS-reachable memory overflow—Citrix and CISA confirm active exploitation and advise immediate patching to fixed builds as no vendor workaround exists.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.