Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix confirms two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are actively exploited for remote code execution.
Citrix released emergency updates in bulletin CTX697096 after confirming active exploitation of CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, on customer-managed NetScaler ADC and Gateway appliances. CVE-2026-88771 allows unauthenticated remote command execution on default configurations, while CVE-2026-88772 is a memory overflow that can cause remote code execution or denial of service when DTLS is enabled, which is default on VPN virtual servers. The bulletin also fixes six more flaws, including HTTP request smuggling CVE-2026-88773, in releases 14.1-73.37, 13.1-64.23, and specified FIPS builds.
- Pre-auth RCE CVE-2026-88771 affects default ADC and Gateway configurations
- CVE-2026-88772 allows RCE or denial of service when DTLS is enabled
- Bulletin CTX697096 fixes eight CVEs, several scored 8.8 to 9.5
- Fixed builds include 14.1-73.37, 13.1-64.23, and listed FIPS releases
- Citrix-managed cloud services are being updated separately
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- Citrix
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
3 min read at gbhackers.com
Citrix has released emergency security updates for NetScaler ADC and NetScaler Gateway after confirming active exploitation of two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772. Both bugs have a CVSS v4. 0 score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.