Hunting Citrix NetScaler zero-days with Corelight

Citrix’s security bulletin CTX697096 , the NetScaler security blog , and WatchTowr’s vulnerability FAQ describe an urgent situation for organizations using NetScaler ADC and NetScaler Gateway. Two vulnerabilities (CVE-2026-88771 and CVE-2026-88772) are known to be exploited . CISA confirms active exploitation globally and has added both to its Known Exploited Vulnerabilities catalog .