Citrix and Elementor face critical security vulnerabilities

Security researchers have identified multiple critical vulnerabilities affecting widely used software. Citrix has confirmed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which are being actively exploited in the wild. These zero-day flaws, including CVE-2026-88771 and CVE-2026-88772, carry a CVSS score of 9.5 and allow for remote code execution or denial-of-service attacks.

Separately, a CSRF vulnerability has been discovered in the Elementor WordPress plugin, specifically affecting versions 4.3.0 and 4.3.1. This flaw, estimated to impact up to two million websites, allows an attacker to create a new administrator account if a logged-in administrator clicks a specially crafted link. A patch was released in version 4.3.2 to address this issue.