CISA says attackers are actively exploiting two Citrix NetScaler flaws globally; Citrix has released fixed versions.