Threat actors are actively exploiting critical pre-authentication command injection vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772). Post-exploitation payloads have been observed creating superuser accounts and mapping web shells to CSS-like URLs to evade detection. These attacks aim to steal configuration data and maintain persistent access. Organizations are urged to patch all customer-managed NetScaler appliances immediately and conduct thorough investigations for any signs of compromise.