Weeks-Long Zero-Day Campaign Exploits NetScaler Flaws in Government and Finance Sectors

Security researchers have observed a sustained intrusion campaign that leverages two newly disclosed NetScaler vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772. The attacks, which have persisted for several weeks, appear to focus on networks operated by government agencies and financial institutions, according to multiple cybersecurity firms that have tracked the activity.

The two flaws affect Citrix NetScaler appliances, a popular line of application delivery controllers used to manage traffic for web applications and services. CVE-2026-88771 is a remote code execution issue that can be triggered without authentication, while CVE-2026-88772 provides a path for privilege escalation once an attacker has a foothold. Both vulnerabilities are classified as zero‑day, meaning they were exploited before patches were publicly released.

Initial detection of the campaign emerged in early September when threat‑intelligence teams noticed anomalous traffic patterns targeting NetScaler endpoints. Subsequent analysis revealed that the malicious actors were using custom exploit code to gain initial access, then moving laterally across internal networks to harvest credentials and exfiltrate data. The focus on high‑value sectors suggests a motive tied to espionage or financial gain, though the precise objectives remain unclear.

Citrix has responded by issuing emergency advisories and releasing patches for the affected firmware versions. Organizations that rely on NetScaler are urged to apply the updates immediately, enable multi‑factor authentication for administrative accounts, and review network segmentation to limit the blast radius of any compromise. Security firms also recommend monitoring for Indicators of Compromise (IOCs) linked to the known exploit tools, as well as conducting thorough log reviews for any signs of unauthorized access.

The episode underscores a broader trend of attackers exploiting newly discovered vulnerabilities in critical infrastructure components before defenders can react. Over the past year, similar zero‑day campaigns have targeted VPN gateways, cloud management consoles, and other remote‑access technologies, highlighting the importance of rapid patch management and continuous threat‑hunts.

Analysts anticipate that further disclosures related to NetScaler may follow, given the platform’s widespread deployment. In the meantime, government bodies and financial firms are expected to heighten their security postures, potentially accelerating migration to alternative solutions or implementing additional compensating controls while they assess the full impact of the breach.