Suspected State-Sponsored Hackers Exploited NetScaler Zero-Day (CVE-2026-88772) Since Early September

Mandiant and Google Threat Intelligence Group (GTIG) have reported that 'advanced and suspected state-sponsored threat actors' have been exploiting a zero-day vulnerability (CVE-2026-88772) in Citrix NetScaler ADCs and Gateways since at least early September 2026. This flaw, along with CVE-2026-88771, allows remote code execution on vulnerable appliances, impacting dozens of organizations across government, financial services, education, telecommunications, and legal sectors in North America and Europe.