2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
CERT-EU warns two critical Citrix NetScaler RCE flaws are exploited in the wild and urges immediate patching.
CERT-EU reported that Citrix’s 27 September 2026 bulletin covers eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, including two critical unauthenticated remote-code-execution flaws that Citrix says are exploited in the wild. CVE-2026-88771 (CVSS 9.5) needs no precondition and affects all deployments; CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to RCE or denial of service where DTLS is enabled. Other issues include HTTP request smuggling (CVE-2026-88773, CVSS 9.3), a policy bypass, three memory overflows, and TCP ISN prediction. Affected builds are 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and specified FIPS and NDcPP versions. CERT-EU advises immediate updates, enabling Enhanced ISN Generation where relevant, and compromise assessment of internet-facing appliances.
- CVE-2026-88771 is unauthenticated RCE, CVSS 9.5, affecting all deployments and exploited in the wild.
- CVE-2026-88772 is a memory-overflow RCE or DoS, CVSS 9.5, when DTLS is enabled, also exploited.
- Six further flaws score CVSS 7.0 to 9.3, including HTTP request smuggling and ISN prediction.
- Patch 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and listed FIPS builds immediately.
- CERT-EU urges compromise assessments on internet-facing appliances running affected builds.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CERT-EU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at cert.europa.eu
On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.