Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation

CVE-2026-88771CVE-2026-88772

September 28, 2026 · Sophos Threat Research · Severity: HIGH

This brief article from Sophos Threat Research confirms that the Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 are being actively exploited. It serves as a threat advisory urging immediate patching and awareness of the ongoing attacks. 📌 **Analyst Note:** The confirmation from a respected threat research team underscores the severity and real-world impact of these vulnerabilities. Security teams should incorporate detection rules for these exploits and ensure that any NetScaler appliances are patched without delay.

Key Takeaways

Sophos Threat Research confirms that the Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 are under active exploitation, aligning with the emergency advisory from Citrix.
These zero-day flaws allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, which are commonly deployed at enterprise network perimeters for application delivery and VPN access.
Organizations using Citrix NetScaler should prioritize applying the vendor's security updates and review their DTLS configuration to mitigate the risk of compromise from these actively exploited vulnerabilities.