Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

Update September 27: Citrix published security bulletin CTX697096, confirming CVE-2026-88771 and CVE-2026-88772 as the two zero-day RCE vulnerabilities and releasing patches. Post updated with CVE IDs, CVSS scores, patch versions, and IoC guidance. September 26: Original publication based on limited public information ahead of Citrix's official advisory.