Citrix security advisory (AV26-965)
CISA added Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772 to the KEV catalog; Canadian Cyber Centre urges immediate patching.
Canadian Centre for Cyber Security advisory AV26-965 (September 28, 2026) covers Citrix NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-63.23, and affected FIPS/NDcPP builds. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities database on September 27, 2026, confirming active exploitation. Citrix's bulletin addresses eight vulnerabilities, CVE-2026-88771 through CVE-2026-88778.
- CVE-2026-88771 and CVE-2026-88772 added to CISA KEV on September 27, 2026
- Affects NetScaler ADC/Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-63.23
- Citrix bulletin covers eight CVEs, CVE-2026-88771 through CVE-2026-88778
- FIPS and NDcPP builds also affected; apply updates as they become available
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Organizations
- CitrixCISACanadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-965 Date: September 28, 2026 As of September 27, 2026, Citrix is affected by vulnerabilities in the following products: NetScaler ADC and NetScaler Gateway 14. 1 Prior to 14. 1-73.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.