Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

Executive Summary Unit 42 is aware of possible zero-day activity against NetScaler devices.

Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild.

As of Sept. 27, 2026, Palo Alto Networks Cortex Xpanse has identified 50,277 exposed instances that could potentially be vulnerable to these CVEs based on our telemetry.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

As of Sept. 27, 2026, Palo Alto Networks Cortex Xpanse has identified the presence of over 50,277 exposed instances potentially vulnerable to these CVEs based on our telemetry.