Citrix NetScaler Zero-Days Under Active Attack, Unit 42 Warns

En bref

• CVE-2026-88771 and CVE-2026-88772 affect Citrix NetScaler.
• Unit 42 reports ongoing attacks against these flaws.
• Successful attacks could lead to device compromise.
• K-12 and government remote access gateways are at risk.
• Apply vendor mitigations and monitor for indicators.

Citrix and Unit 42 have disclosed two vulnerabilities in NetScaler, tracked as CVE-2026-88771 and CVE-2026-88772. These are zero-day flaws, meaning they were exploited before a patch was available. Unit 42 has observed real-world attacks targeting these issues.

NetScaler is widely used as a remote access and application delivery controller, including in K-12 and government networks. A compromised appliance can serve as a foothold for attackers to move laterally, access sensitive student or staff data, or disrupt services. The impact includes potential full device takeover.

The fact that exploitation is occurring in the wild raises urgency. Unit 42's threat brief indicates active campaigns. Organizations that expose NetScaler management interfaces or VPN endpoints to the internet are most at risk. Even if not directly targeted, the prevalence of scanning means any unpatched system is a candidate.

For New Brunswick schools and government agencies, this is a reminder to inventory internet-facing assets. Many districts rely on NetScaler for remote learning and administrative access. A single compromised gateway could affect thousands of users. Coordination with vendor guidance and threat intelligence is essential.

What to watch: Citrix's advisory and any patches, Unit 42's indicators of compromise, and unusual authentication or outbound traffic from NetScaler devices. Until patches are applied, mitigation such as restricting access or enabling enhanced logging is critical. Monitor for signs of persistence.

À faire maintenant

1. Immediately inventory all NetScaler instances, prioritizing internet-facing management interfaces and VPN endpoints.
2. Apply Citrix patches or mitigations as soon as they become available.
3. If patching is not possible, isolate the appliance or restrict management access to trusted IP addresses.
4. Review Unit 42's threat brief for indicators of compromise and hunt for signs of intrusion.
5. Reset credentials and revoke active sessions on any potentially affected NetScaler device.
6. Enable multi-factor authentication and robust logging for all administrative access.
7. Monitor for anomalous authentication attempts or outbound traffic and report incidents to your cybersecurity team.

Références CVE

• CVE-2026-88771
• CVE-2026-88772

Source originale

Unit 42