Threat actors linked to ransomware group Royal are actively exploiting a vulnerability in two Citrix products, researchers found.