Ep. 87 - Citrix NetScaler Zero-Days: Code Execution on Your Edge Box, No Login, No Special Config

Two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild before a patch existed, and 88771 hits every configuration with no login required. Tova Dvorin and Adrian Culley break down Citrix bulletin CTX697096 and all eight CVEs, why this is NetScaler’s third CISA KEV entry in five weeks, and why patching won’t tell you whether you were already breached.

00:00 Which Citrix NetScaler zero-days were exploited before patches?

01:06 What do the eight vulnerabilities affect?

04:11 Why do attackers target edge appliances?

04:47 What can attackers do without logging in?

06:42 When did exploitation begin, and which versions need updating?

08:36 Why doesn’t patching rule out a compromise?

12:48 How can teams verify their detections would catch an attack?

#cybersecurity #infosec #CISO #Citrix #NetScaler #ZeroDay #CISAKEV