Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

According to coverage from multiple security sources including Unit 42, Rapid7, and Help Net Security, two critical Citrix NetScaler remote code execution zero-day vulnerabilities designated as CVE-2026-88771 and CVE-2026-88772 are currently under active exploitation in the wild. Outlets such as The Hacker News, BleepingComputer, and The Register report that these vulnerabilities impact Citrix NetScaler ADC and Gateway products globally. Research teams including watchTowr Labs have identified the issues as pre-authentication command injections affecting unpatched systems. Hospitals and government entities are reported to be among those affected, with DutchNews.nl noting that hospitals blocked access to patient records following cyber threats, while Techzine Global highlights broader impacts on public sector and medical infrastructure. The situation has drawn urgent warnings and directives from major cybersecurity authorities worldwide, as detailed in reports from CISA, the Australian Cyber Security Centre, and the Hong Kong Computer Emergency Response Team Coordination Centre.

BleepingComputer and Network World emphasize that administrators have been explicitly instructed to patch the critical zero-days immediately or even shut down vulnerable NetScaler appliances. CISA has issued specific directives ordering federal agencies to apply patches by Wednesday. Meanwhile, specialized threat briefs from Unit 42, Rapid7, and cyberkendra.com outline the technical nature of the flaws, while publications like heise online and thestack.technology track the unfolding response across international markets. Background information provided across the coverage indicates that these events fit into a recurring pattern of critical enterprise gateway vulnerabilities being targeted by threat actors on a global scale. Outlets like The Register draw parallels to historical enterprise software flaws, highlighting the immediate risks posed when remote code execution vulnerabilities are left unpatched.

The involvement of organizations like watchTowr, which published detailed technical assessments regarding the pre-auth command injection capabilities of CVE-2026-88771, underscores the urgency with which security researchers and vendors are racing to understand and mitigate the active exploitation campaigns currently underway. As the situation develops, stakeholders are closely monitoring official advisories from CISA, the ACSC, and Citrix itself, which has released emergency patches for the affected NetScaler ADC and Gateway products. Coverage from outlets such as LinkedIn and Network World indicates that administrators are scrambling to verify their appliance security postures in light of the looming Wednesday federal patching deadlines. Further updates are expected regarding the extent of global compromises, additional emergency mitigations, and the ongoing telemetry gathered by threat intelligence units tracking the active exploitation of CVE-2026-88771 and CVE-2026-88772.