2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
CERT-EU warns two critical Citrix NetScaler RCE flaws are exploited in the wild and urges immediate patching.
CERT-EU reported that Citrix’s 27 September 2026 bulletin covers eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, including two critical unauthenticated remote-code-execution flaws that Citrix says are exploited in the wild. CVE-2026-88771 (CVSS 9.5) needs no precondition and affects all deployments; CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to RCE or denial of service where DTLS is enabled. Other issues include HTTP request smuggling (CVE-2026-88773, CVSS 9.3), a policy bypass, three memory overflows, and TCP ISN prediction. Affected builds are 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and specified FIPS and NDcPP versions. CERT-EU advises immediate updates, enabling Enhanced ISN Generation where relevant, and compromise assessment of internet-facing appliances.
- CVE-2026-88771 is unauthenticated RCE, CVSS 9.5, affecting all deployments and exploited in the wild.
- CVE-2026-88772 is a memory-overflow RCE or DoS, CVSS 9.5, when DTLS is enabled, also exploited.
- Six further flaws score CVSS 7.0 to 9.3, including HTTP request smuggling and ISN prediction.
- Patch 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and listed FIPS builds immediately.
- CERT-EU urges compromise assessments on internet-facing appliances running affected builds.
Vulnerabilities mentionedAll →
- CVE-2026-887729.51%Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gatewaypublished · Citrix NetScaler ADC KEV PoC ×2+1 related
Full article477 words · extracted from cert.europa.eu · click to collapse
Release Date: 27-09-2026 17:40:52
History:
- 27/09/2026 --- v1.0 -- Initial publication
Summary
On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild [1].
CERT-EU recommends updating affected software and running a compromise assessment on those exposed on the internet.
Technical Details
The vulnerability CVE-2026-88771, with a CVSS score of 9.5, is an unauthenticated RCE flow due to improper input validation. As there is no precondition for the exploitation, it affects all Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. It is exploited in the wild [1].
The vulnerability CVE-2026-88772, with a CVSS score of 9.5, a memory overflow vulnerability leading to RCE or Denial of Service (DoS). It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where DTLS is enabled (default on VPN vServer). It is exploited in the wild [1].
The vulnerability CVE-2026-88773, with a CVSS score of 9.3, is an HTTP Request Smuggling vulnerability. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1].
The vulnerability CVE-2026-88774, with a CVSS score of 7.0, is a feature policy bypass via HTTP URL-based expression flow. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1].
The vulnerabilities CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777, each with a CVSS score of 8.8, are memory overflow vulnerabilities leading to unpredictable or erroneous behaviour or DoS conditions. They affect Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where respectively, a gateway or AAA vServer is configured, an LB vServer of type Oracle is configured, or an LB/CS or CGNAT-LSN/NAT64 with non-HTTP L7 protocol is enabled [1].
The vulnerability CVE-2026-88778, with a CVSS score of 8.8, is a TCP Initial Sequence Number (ISN) prediction vulnerability. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where a TCP configuration is enabled with Enhanced ISN Generation disabled [1].
Affected Products
The following products and versions are affected [1]:
- Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23 and 14.1 before 14.1-73.37.
- Citrix NetScaler ADC FIPS version 14.1 before 14.1-73.37 FIPS
- Citrix NetScaler ADC FIPS and NDcPP version 13.1 before 13.1-37.279
This bulletin applies to customer-managed deployments only. Secure Private Access Hybrid deployments using NetScaler instances are also affected and must be upgraded.
For precondition verification steps, refer to the Citrix bulletin [1].
Recommendations
CERT-EU recommend to update all affected customer-managed appliances to the fixed version immediately. It is also recommended to enable Enhanced ISN Generation for deployments where a TCP configuration is enabled [2].
CERT-EU strongly advise to run a compromise assessment on any internet-facing appliance running an affected build.
References
[1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096