Citrix NetScaler vulnerabilities were exploited on unmitigated deployments
On September 27, 2026, Citrix published fixes for NetScaler ADC and NetScaler Gateway. CVE-2026-88771 lets an unauthenticated attacker run commands on a default deployment, and Citrix says exploits of that bug and CVE-2026-88772 have been observed.