Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
Attackers are exploiting critical Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for unauthenticated remote code execution.
95
CVE-2026-88777
Memory overflow in Citrix NetScaler ADC and Gateway
- CVSS 4.0
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-88777 is a memory overflow in Citrix NetScaler ADC and Citrix NetScaler Gateway that can cause unpredictable or erroneous behavior or a denial of service. It is reachable over the network with no privileges and no user interaction (CVSS 4.0 8.8); the scored impact is low confidentiality and integrity loss and high availability loss, and the advisory text does not describe remote code execution. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those ADC or Gateway releases, especially internet-facing appliances, are exposed. No public proof-of-concept is known and the CVE is not in CISA KEV; a related headline about exploited NetScaler zero-day RCE does not name this CVE and is not treated as confirmation for it.
What to do: Upgrade Citrix NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23 (or later in those trains), ADC FIPS to 14.1-73.37 or later, and ADC FIPS/NDcPP to 13.1.37.279 or later. Until patched, limit internet exposure of ADC and Gateway services and watch for crashes, session errors, or other availability failures.
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | before 14.1-73.37 and before 13.1-64.23 |
| Citrix NetScaler ADC FIPS | before 14.1-73.37 FIPS |
| Citrix NetScaler ADC FIPS and NDcPP | before 13.1.37.279 |
| Citrix NetScaler Gateway | before 14.1-73.37 and before 13.1-64.23 |
Estimated exposure
largeon the order of tens of thousands of internet-exposed appliances (roughly 10,000–100,000) — Estimate from typical public internet-scan counts of exposed NetScaler ADC/Gateway appliances (commonly on the order of tens of thousands) and their widespread use as enterprise load balancers and remote-access gateways; not a census of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
- Vendors
- citrix
- Products
- netscaler application delivery controller, netscaler gateway
- Weakness
- CWE-119
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
14 storiesCitrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix confirms two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are actively exploited for remote code execution.
94
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
92
NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix and CISA warn NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active attack.
92
Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
92
Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack
Citrix confirms attackers are exploiting two critical unauthenticated NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772.
92
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
Two critical Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are exploited for remote code execution.
91
Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
watchTowr details CVE-2026-88771, a pre-auth command injection in Citrix NetScaler ADC/Gateway patched in bulletin CTX697096 and already exploited as a zero-day.
90
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
watchTowr dissects CVE-2026-88772, an in-the-wild-exploited pre-auth DTLS memory overflow in Citrix NetScaler enabling RCE, one of eight fixed flaws.
88
Citrix NetScaler ADC and Gateway Zero-day Vulnerabilities Exploited in Attacks (CVE-2026-88771 & CVE-2026-88772)
CISA says exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 need urgent patching.
88
NCSC Urges UK organizations to Patch for Citrix NetScaler ADC and Gateway 0-Day Vulnerabilities
The UK NCSC urged immediate patching after two critical Citrix NetScaler zero-days were exploited for unauthenticated remote code execution.
88
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
NCSC warns exploited Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772 allow remote compromise.
88
2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
CERT-EU warns two critical Citrix NetScaler RCE flaws are exploited in the wild and urges immediate patching.
88
Citrix security advisory (AV26-965)
CISA added Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772 to the KEV catalog; Canadian Cyber Centre urges immediate patching.
78