Citrix NetScaler ADC and Gateway Zero-day Vulnerabilities Exploited in Attacks (CVE-2026-88771 & CVE-2026-88772)
CISA says exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 need urgent patching.
CISA added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog and ordered agencies to patch Citrix NetScaler ADC and Gateway before September 30, 2026. CVE-2026-88771 is an improper input validation flaw that can let an unauthenticated attacker run arbitrary commands and affects default deployments. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled, which is on by default for VPN virtual servers. Citrix bulletin CTX697096 also fixes CVE-2026-88773 through CVE-2026-88778, including request smuggling, policy bypass, and denial-of-service bugs, in 14.1-73.37, 13.1-64.23, and corresponding FIPS builds.
- CVE-2026-88771 allows unauthenticated command execution on default NetScaler setups.
- CVE-2026-88772 can yield remote code execution or denial of service via DTLS.
- Both flaws are in CISA's KEV catalog with a September 30, 2026 deadline.
- Fixed builds include 14.1-73.37 and 13.1-64.23, plus listed FIPS releases.
- Six further issues, CVE-2026-88773 through CVE-2026-88778, were also patched.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
3 min read at threatprotect.qualys.comThe Cybersecurity and Infrastructure Security Agency (CISA) has ordered agencies to secure their systems against two critical Citrix NetScaler vulnerabilities that have been exploited in attacks. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch the vulnerabilities before September 30, 2026.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.