New vulnerabilities in Citrix Netscaler allow for code execution
Security researchers have identified two new zero-day vulnerabilities in Citrix Netscaler that allow for code execution on vulnerable devices. Patches are now available for immediate deployment.
Administrators of Citrix Netscaler instances are urged to update their devices immediately following reports of two new zero-day vulnerabilities circulating that allow for code injection. The manufacturer has not yet issued an official statement, and no warnings have been released by cybersecurity authorities.
Threat intelligence firm WatchTowr reported the existence of two remote code execution (RCE) vulnerabilities, stating they were discovered during forensic analysis and are being exploited in the wild. Citrix is reportedly working on an official statement and patches, expected early this week.
The vulnerabilities have been deemed credible by figures like British security researcher Kevin Beaumont and have been confirmed by users on platforms such as Reddit. US cybersecurity agency CISA and Dutch NCSC have issued alerts regarding these issues. Two specific vulnerabilities, CVE-2026-88771 and CVE-2026-88772, permit remote code execution with a critical CVSS score of 9.5 out of 10.
Citrix has since released a security advisory and remediation guidelines detailing several critical and high-severity CVEs. The company is now distributing two new versions of NetScaler OS to customers that address these vulnerabilities. Administrators are strongly advised to install the updated versions promptly to prevent exploitation by cybercriminals.