Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.

CVE-2026-88773 is a critical HTTP request/response smuggling flaw (CWE-444) in Citrix NetScaler ADC and Citrix NetScaler Gateway, caused by inconsistent interpretation of HTTP requests. A remote attacker can send a crafted request over the network with no privileges and no user interaction so the appliance and a downstream component disagree on where one request ends and the next begins. CVSS 4.0 scores this 9.3, with high integrity impact on the vulnerable system and high confidentiality and integrity impact on subsequent systems, and no availability impact; the CVE record does not describe remote code execution. It affects ADC builds before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP, and Gateway builds before 14.1-73.37 FIPS and before 13.1-64.23. No public proof of concept is known and the CVE is not in CISA KEV; a related headline about actively exploited NetScaler RCE issues is not identified as this smuggling flaw.

Do: Upgrade NetScaler ADC to 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, or 13.1-37.279 NDcPP or later, and NetScaler Gateway to 14.1-73.37 FIPS or later or 13.1-64.23 or later, prioritizing internet-facing appliances. After patching, review HTTP and security logs for anomalous or desynchronized requests and invalidate sessions that may have been poisoned. No public exploit is known and this CVE is not in CISA KEV, but unauthenticated network access makes prompt patching appropriate.