The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure vulnerable Citrix NetScaler systems by September 30, 2026, after Citrix confirmed active global exploitation of two (2) critical zero-day vulnerabilities, both rated CVSS 9.5/10. CVE-2026-88771 is an improper input validation flaw affecting all NetScaler ADC and Gateway deployments that allows unauthenticated arbitrary command execution, while CVE-2026-88772 is a memory overflow vulnerability enabling remote code execution (RCE) or denial-of-service (DoS) when DTLS is enabled, which is the default on VPN virtual servers. Technical analysis from watchTowr found that CVE-2026-88771 involves unsafe command construction in the ns_monuploadd_err.pl Perl script, allowing attacker-controlled data supplied through a pre-authentication endpoint to ultimately execute commands as root. Citrix released fixes in NetScaler and corresponding supported FIPS/NDcPP releases, while end-of-life 12.1 and 13.0 installations should migrate to supported versions. Prior to public disclosure, cybersecurity organizations and national agencies reportedly warned customers to prepare for emergency remediation after exploitation was detected at multiple organizations worldwide, with one (1) vulnerability reportedly capable of placing shellcode directly into memory. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) Catalog, while Citrix provided generic indicators of compromise and advised potentially affected organizations to preserve forensic evidence, isolate compromised appliances, rotate credentials and encryption keys, investigate connected systems, and rebuild affected devices. With more than 23,000 Internet-exposed systems displaying NetScaler fingerprints, the vulnerabilities present a significant attack surface, particularly because NetScaler appliances commonly operate as Internet-facing edge devices that can provide attackers an initial foothold into internal corporate networks. CTIX analysts urge any affected administrators to follow the Citrix/CISA guidance to prevent exploitation.