Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

Unit 42 and Citrix report active exploitation of two critical NetScaler vulnerabilities (CVE-2026-88771 — unauthenticated RCE, and CVE-2026-88772 — DTLS memory overflow enabling RCE or DoS). Both have CVSS v4.0 base scores of 9.5; Palo Alto Networks telemetry identified ~50,277 potentially exposed instances. The advisory urges immediate patching, exposure confirmation, isolation, evidence preservation, and hunting for suspicious activity, and includes Unit 42 incident response contact information.