Google Cloud Warns of Active Zero-Day Exploitation in Citrix NetScaler ADC and Gateway Appliances

Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of two zero-day vulnerabilities (CVE-2026-88772 and CVE-2026-88771) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. The exploitation bypasses authentication and establishes root-level access, impacting organizations in North America and Europe across government, financial services, education, legal, and professional services sectors.