Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
NCSC warns exploited Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772 allow remote compromise.
The UK NCSC said eight vulnerabilities affect on-premises Citrix NetScaler ADC and NetScaler Gateway, and that CVE-2026-88771 and CVE-2026-88772 are confirmed actively exploited. CVE-2026-88771 is improper input validation that lets an unauthenticated remote attacker execute arbitrary commands. CVE-2026-88772 is a memory-bounds flaw that can lead to remote code execution or denial of service. Affected supported versions are 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and listed FIPS builds; NCSC recommends isolation, IoC investigation, patching, and continued hunting.
- CVE-2026-88771 allows unauthenticated remote command execution.
- CVE-2026-88772 can cause remote code execution or denial of service.
- Six further flaws include smuggling, policy bypass, overflows, and predictable values.
- Fixed builds include 14.1-73.37 and 13.1-64.23, plus listed FIPS releases.
- NCSC urges isolation, indicator hunting, patching, then monitored restoration.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- NCSC
- Countries
- United Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at ncsc.gov.uk
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
ncsc.gov.uk
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.