Citrix issues fixes for NetScaler flaws reported under active attack

Citrix has issued an advisory and fixes for critical NetScaler vulnerabilities after security researchers reported exploitation in the wild, heise reported. Two flaws, CVE-2026-88771 and CVE-2026-88772, allow remote code execution; the first affects default configurations. A third critical flaw affects NetScaler ADC or Gateway instances with HTTP enabled. The US cybersecurity agency CISA has listed exploited vulnerabilities and issued an alert. Citrix has listed replacement NetScaler OS versions 13.1-64.24 and 14.1-37.73 on its download page for customers. Support representatives described an early access build as unfinished and warned that it could contain bugs or other defects, leaving administrators to weigh that risk against the reported attacks.