# Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

> **Open Intelligence Dossier** · First detected: 2026-09-27 20:00 UTC · Category: Business

## Executive Summary
Global alerts sound as two critical Citrix NetScaler zero-day vulnerabilities face active exploitation.

## Intelligence Brief
According to coverage from multiple security sources including Unit 42, Rapid7, and Help Net Security, two critical Citrix NetScaler remote code execution zero-day vulnerabilities designated as CVE-2026-88771 and CVE-2026-88772 are currently under active exploitation in the wild. Outlets such as The Hacker News, BleepingComputer, and The Register report that these vulnerabilities impact Citrix NetScaler ADC and Gateway products globally. Research teams including watchTowr Labs have identified the issues as pre-authentication command injections affecting unpatched systems. Hospitals and government entities are reported to be among those affected, with DutchNews.nl noting that hospitals blocked access to patient records following cyber threats, while Techzine Global highlights broader impacts on public sector and medical infrastructure. The situation has drawn urgent warnings and directives from major cybersecurity authorities worldwide, as detailed in reports from CISA, the Australian Cyber Security Centre, and the Hong Kong Computer Emergency Response Team Coordination Centre.


BleepingComputer and Network World emphasize that administrators have been explicitly instructed to patch the critical zero-days immediately or even shut down vulnerable NetScaler appliances. CISA has issued specific directives ordering federal agencies to apply patches by Wednesday. Meanwhile, specialized threat briefs from Unit 42, Rapid7, and cyberkendra.com outline the technical nature of the flaws, while publications like heise online and thestack.technology track the unfolding response across international markets. Background information provided across the coverage indicates that these events fit into a recurring pattern of critical enterprise gateway vulnerabilities being targeted by threat actors on a global scale. Outlets like The Register draw parallels to historical enterprise software flaws, highlighting the immediate risks posed when remote code execution vulnerabilities are left unpatched.


The involvement of organizations like watchTowr, which published detailed technical assessments regarding the pre-auth command injection capabilities of CVE-2026-88771, underscores the urgency with which security researchers and vendors are racing to understand and mitigate the active exploitation campaigns currently underway. As the situation develops, stakeholders are closely monitoring official advisories from CISA, the ACSC, and Citrix itself, which has released emergency patches for the affected NetScaler ADC and Gateway products. Coverage from outlets such as LinkedIn and Network World indicates that administrators are scrambling to verify their appliance security postures in light of the looming Wednesday federal patching deadlines. Further updates are expected regarding the extent of global compromises, additional emergency mitigations, and the ongoing telemetry gathered by threat intelligence units tracking the active exploitation of CVE-2026-88771 and CVE-2026-88772.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Unit 42 | Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild | [Source Link](https://news.google.com/rss/articles/CBMidEFVX3lxTE15bnA1UU9KZVRyNHVhSUxlNDB5UldOSUJNOEp6RWJGajl4M0tZUUxPdkk5N0pkbmQwS21yN2lzNWVmblJTMGVmbWtoTVJPWWR0bFdka2xnc0otTC1fczd3cjBUeGhqZzFvUXlDR2lJZzNKR0Ro?oc=5) |
| Rapid7 | Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 | [Source Link](https://news.google.com/rss/articles/CBMiyAFBVV95cUxOQUUtbE43MU9RQXUtbVFJWHo4Z1dDTEp5b0U1NGhya2s1MFVralVmdjdscHVPcjBTQUMyNEI5NnN6UWVSTVhlalRhMi1VNHFlQk5rM3dOaGJRZW1YSWttZkYwWEZ3WjlzajhQZktSbjhINUxicjNHVGszeG5OM1RxOWYxd3Zzc1FoaDdBOEI4cUd3VU9vV3RVUjl2WkhCRWQycnAtM0NmS2dvTDhWS0wtSUR3YUM1WWVnRjRGYmU1Q3Rrc0s5clNPRA?oc=5) |
| Help Net Security | Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) | [Source Link](https://news.google.com/rss/articles/CBMiwgFBVV95cUxOYjdIMFVpTXpQMHB3RnZmZlNIVXJ1UHl6V2RLZENGRUYxeG9sZnd1dm80aVd3elVXRl80Z1M3V3FjREEtOEhTejN3LVRZa2c4UkNVMS1CZUQ0eVpYaWNvY2kxOHl4d29XVS1iSXRuVG5uanU2dUtoa3FKRlZLSWhCWFcwM0JWMDJ6QTJiUzRwcGZ6clNOOUQwLW84UjFyaEZVUFcxMzlvZnFvSExCOU5fWG10Y3YwU1RxemN1UDZ0eGlFdw?oc=5) |
| watchTowr Labs | Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxPUnI4b2JTVDlieEZMVGxLQkIzaV9hR2VxSGxYTVRZTlNyb3dNRHZDR2FBQXRhaElDQVBnWFpaSVBHUHllNGxZaFJMcG1lZVhOZWtTcmVWenRMTk5meE5tWjdtQk1WUnZDRWRwM2t2clpCT0lUOHhKdEhOOC1Bc0pIWUZGMnZUSy1uTkQwLXZMM3BvT2Etd1B4VUdNbEVJVXFucUhNTVBvQzNiS1BQZWRYUmw1RmZZOUwwT25jTXlR?oc=5) |
| Network World | NetScaler admins told to patch critical zero-days in ADC and Gateway now | [Source Link](https://news.google.com/rss/articles/CBMivwFBVV95cUxNSFZlOVFEdnRBeXNidUJrOUJ3MWM3MzhaajE3SWkxRVlfRFd2dmNlcXZjV3I4MDVkR05ETUpIWDBKSkhtNHJ3bFhlTFdCR3ZFM095YV9SNmdBUDRJSmdwZWlPcWtlZXRjUFE5bTJxa1ZtNGRkUUxRWXV5cDZLUjVWZEJuMjF5TnA1cEhSQUtPcUkwNVJXZE9rcFZnWUJaaG9BR2RzSkF6b0pqSm9mODdCbzhsdkRIMExTQmJsQkIyMA?oc=5) |
| DutchNews.nl | Hospitals block access to patients’ records after cyber threat | [Source Link](https://news.google.com/rss/articles/CBMimwFBVV95cUxNaktuSUlVZTAxeUJLR1ZQTUxSdkg2aEFOMWpKQkoybEw5Y25JYXhyNlpCNkVQUTRTTEcxeFQ4dmVGeGFtS1phM20yQkU2MjlQcUlqSFZCX0l3T05TcWMwcE1ueURfcDVHWmxLMkJzNm9KdDR3Z1AwcDdFU1BvSEN1dGlVY3BETWIxN3NDc1JZNkNVT3o3QVFJbXRHQQ?oc=5) |
| The Hacker News | CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally | [Source Link](https://news.google.com/rss/articles/CBMigwFBVV95cUxNekdwSDJ1ZE9xN0p2NnVUTllGckdROVcwYUVCMHZYQ2xnQlR2NFdwT2RNeVVEZ2xzdXduMmE2ZmVuUUtucXgyUXdjZDNsQ19NcDIwVUZ2SEdQOGV2R2Q2YWtfLUZQQlIzdlhvUHROY3psdFJNR3NTYUZzM3A1S2ZGRFh4Zw?oc=5) |
| bleepingcomputer.com | CISA orders feds to patch exploited Citrix flaws by Wednesday | [Source Link](https://news.google.com/rss/articles/CBMirgFBVV95cUxOMVBpS1hibVVnT3kxXzBVYk03dVhHNl9jdVl3aWF5SUk3WkNPRFoyaWcxOWJVWTBFTWpXSWJrZnhLelFCcXU4aFFzd2JTUUZNdUpWYktjQ2dISk1ubmpKUkh0UWFLRFJneUItME9vSkk1TlhsZnl4SlB6TnFKcWRiWTBlVEdFQS1nNENfTzRFSVp2b1cwaWdpbk04SnRwa3pyaU5SemJCR2RMR1ZJSFHSAbMBQVVfeXFMTkJYa2pwNndtR0Y2dkxIaXU1MDlRMHNaa2dVRVpodjVRWDdCbGIxX1BvdE9jV1d5SlpNUmJlRk1Da054bE1BNkh5TWdBRXZSS0RLZXI4TGpCZWVtR3JyV0tlR3JHQmVmRUZ1cWI5VE04a0FHN3BSM2FqX05La0d4UDk5Ry1qakx6LVdXV1AtR1JGaE1JT01oSUg2bGJsY19jZUdNU3J) |
| Techzine Global | New Citrix vulnerability affects hospitals and government | [Source Link](https://news.google.com/rss/articles/CBMipgFBVV95cUxQaFcwMWpaTmUyaEFxVkZpUm0zNVl1T3dHTGh4SWh2a3JpeFpvLWs2TlhZTHZ1a0lJVjRRdWo5Z2VnbUdhWTFtWE9XeE1uQmd1a0llY0JjZDRsWHlJeEtPSTFaYkdRM1BpNzJSWnZJTUd0MVZ5REZVT2VWWEdyU2RINXg5NDd1N3RvYW9fakdsaU92RHFhLVBudUcxSDFwdkpZb1hIZXl3?oc=5) |
| The Register | Certainties in life: Death, taxes, and critical Citrix vulns under attack | [Source Link](https://news.google.com/rss/articles/CBMixAFBVV95cUxNLUFib2hTM3NpWDYyZEJCLXRUZWJxMXltcnBmeklkd0ZsWk5GcFZNN1IxTFlNLTE5MGpKUEdRRl9TVUVDNUI5QjM0bkRfRWg2SkotMGU1aGk0T29iYWlRbFBSX3hHb01jU0ZKUGRNLUxhV0FTZXlvSm5yWDVVLTB2SVNhOEQyTDliZGY0bF9FY010X3JGUlFVUXFZZmRDak0wTVhBQzlsYlk3ZVF6WFNGUk8zbDhvQnc4N0dLZWQxSk03SHJa?oc=5) |
| Technology Decisions | ACSC raises critical alert for vulnerabilities in two Citrix products | [Source Link](https://news.google.com/rss/articles/CBMi1wFBVV95cUxQc2hVTHZ5NEdfOU5UMXpZUTlqRHRNT1pnVUxHd1Q1Z3BQN0liYlBicGRiVXpYU2hHNVYwLXM1ZWY1bWxEVW9WQnJmSFA5c1M0dDEwTU9xblNOWnYtX0prMjdHZ2ZTQ28tNGV2bVNwSDJTSG53aHpiNG1VOTEwVFdWTU9IUUVTZDVrUUZGMVlZNk04Z2Q2OEFjdXQ5ZWQ2aDIwOU95am5ta0RpclRlOUdESmNLc3V4XzV4VFlMcHhKc2JncE9EUktzRExtTnN0OVZzdGlOX2hLcw?oc=5) |
| Hong Kong Computer Emergency Response Team Coordination Centre | Citrix Products Multiple Vulnerabilities | [Source Link](https://news.google.com/rss/articles/CBMilAFBVV95cUxPYnI4THAtWmdMZXVZZ0JLRkN4RU5pTXNxX2Q2YkQ3d1ZQNWVjUmhXeE9DbkRoT2pTalBjY1NiSG1lcVU5NWtMVjZzYlRkQ2dsclNYeDBXQUF5T20wRkNCNzBkem5MelEyd1QxY085bmh2S0pnRmR3aG0xdldBaldwU0R6SC03N2xQWllSZ3lfMnRhNklX?oc=5) |
| cyberdaily.au | Act Now! ACSC & CISA urge immediate action over raft of new Citrix NetScaler ADC & Gateway vulnerabilities | [Source Link](https://news.google.com/rss/articles/CBMi2gFBVV95cUxNUGpzcWFXN3VxTDZXaGlhNlJZNlZ6UUk1VXV3N1NTbmtHZ0FDLXVaYWNFcms3WW5HUjZrMFBRX0M3R3JkbDZJcGdHcy15bVZuRmZDMnp1MTB2U3FrWVRzRnVjS2M0VlFzNVBNZXhuVk82eENRMXdDb29kWWhRSFJfZVlxblhQX1pILVhJVjZuYmRpSS0zeGVYRl8yZnY2OTRVN1kyb3prNjh3bHNnY2l4MnpMakQxeGEwYkJWSUpCZ1pyUHpTa2o4dkpoWW81SlNmSWFaMG5EU3Y4UQ?oc=5) |
| australiancybersecuritymagazine.com.au | ACSC warns of actively exploited vulnerabilities in Citrix NetScaler products | [Source Link](https://news.google.com/rss/articles/CBMiwwFBVV95cUxNTmtkV3lSYkhIOHBhdS1paUl4WlNoQUYtcXpWWUJjUzNhWUVzX1B6NmVsak53S3pSakNSd0xYY2NTdE45OERESmFhSFdIaUdBa1RoU2ZQUGRackxhVUZrZ3dOQ09Kd2VuWDNaVlJFYUpLYlBZcWRUOEljTzZlTHZHM2llRWlQTmpNRko3MWRTNVRDOWN5RkdKSnVJNTczbGJCMUplVDR2ejI3cGJsc1ZlV08zVHZsNHM4YmdyRm05MERGbk0?oc=5) |
| watchTowr | CVE-2026-88771, CVE-2026-88772: Citrix NetScaler RCE Zero-Days | [Source Link](https://news.google.com/rss/articles/CBMiugFBVV95cUxOVjQxbE9aaThWZDcyX0Ixcl9NeFpzVGVUR0VTR2pKMEI4ek5YVlI4NG9jVzI4X2htR3pzaURNMmlEeEhZZzVoSy1idTJubTVqM3NubnFMbnRBemVqTlhOdElpa1p2VWx0VmJrMGQ2SV9hMEtPWEJ6MVphMDEtandPY0toOUl3WE0zamRiVTlXdjBzWklKNjFHdU9kNkhDTW13Wmh2cV9ZWDJmOUxCd2l4UHZBWVJmV2tKQ3c?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-09-27/warning-two-unpatched-citrix-netscaler-rce-zero-days-under-active-exploitation*