Citrix Patches Critical Zero Days Under Active Exploitation

Citrix published patches for eight vulnerabilities in NetScaler ADC/Gateway, including two critical zero-day flaws enabling unauthenticated remote code execution (CVE-2026-88771) and a DTLS-related memory overflow (CVE-2026-88772) that have been observed exploited in the wild; multiple national agencies (ACSC, CISA, NCSC-NL) have issued urgent patching advisories and the issues affect default deployments and DTLS-enabled VPN vServers, with CVSS scores up to 9.5.