Citrix has issued emergency security updates for NetScaler ADC and NetScaler Gateway after confirming active exploitation of two critical zero-day remote code execution vulnerabilities.
The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, each have a CVSS v4 score of 9.5 and affect unmitigated, customer-managed NetScaler appliances.
The vulnerabilities are part of a wider security bulletin, CTX697096, addressing eight NetScaler issues ranging from remote code execution and denial of service to HTTP request smuggling, policy bypass, and TCP initial sequence number prediction.
Citrix Confirms NetScaler Zero-Day RCE Flaws
CISA has urged organizations to assess for compromise before applying updates where feasible, noting that malicious actors are exploiting at least some of the newly disclosed vulnerabilities.
CVE-2026-88771 is the most broadly exposed flaw in the bulletin. It stems from improper input validation and can enable an unauthenticated remote attacker to execute arbitrary commands.
Citrix said every NetScaler ADC and NetScaler Gateway deployment is affected, including appliances running the default configuration, with no optional feature or service required for exposure.
CVE-2026-88772 is a memory-overflow vulnerability that can lead to remote code execution or denial of service when Datagram Transport Layer Security (DTLS) is enabled.
DTLS is enabled by default on VPN virtual servers, making externally accessible NetScaler VPN infrastructure a priority for immediate review and patching. Citrix has observed exploitation of both critical vulnerabilities on unmitigated deployments.
| CVE | Vulnerability | Preconditions | CVSS v4 |
|---|---|---|---|
| CVE-2026-88771 | Unauthenticated remote code execution through improper input validation | All ADC and Gateway deployments, including defaults | 9.5 |
| CVE-2026-88772 | Memory overflow enabling RCE or DoS | DTLS enabled; commonly enabled by default on VPN virtual servers | 9.5 |
| CVE-2026-88773 | HTTP request smuggling | HTTP configuration enabled | 9.3 |
| CVE-2026-88774 | Feature-policy bypass tied to HTTP URL expression handling | HTTP configuration enabled | 7.0 |
| CVE-2026-88775 | Memory overflow causing erroneous behavior or DoS | Gateway or AAA virtual server configured | 8.8 |
| CVE-2026-88776 | Memory overflow causing erroneous behavior or DoS | Oracle-type load-balancing virtual server configured | 8.8 |
| CVE-2026-88777 | Memory overflow causing erroneous behavior or DoS | LB/CS or CGNAT-LSN/NAT64 with non-HTTP Layer 7 functionality | 8.8 |
| CVE-2026-88778 | TCP initial sequence number prediction | TCP services enabled and Enhanced ISN Generation disabled | 8.8 |
Citrix recommends updating affected systems to NetScaler ADC and Gateway 14.1-73.37 or later, or 13.1-64.23 or later. FIPS deployments should move to 14.1-73.37 FIPS or 13.1-37.279 FIPS/NDcPP, as applicable. Versions earlier than these releases are affected.
Administrators should inventory every internet-facing NetScaler appliance, identify DTLS-enabled VPN virtual servers, and review HTTP, Gateway, AAA, Oracle load-balancing, and non-HTTP Layer 7 configurations.
Organizations should also check whether Enhanced ISN Generation is disabled, as this condition exposes systems to CVE-2026-88778.
The capability requires the telemetry channel and supports an initial scan for potential compromise, though Citrix cautions that indicators cannot identify every attacker technique or confirm an appliance is clean.
Organizations that detect suspicious changes should preserve logs, forward NetScaler telemetry to a SIEM platform, investigate authentication and configuration activity, and engage incident-response specialists where compromise is suspected.
Given the unauthenticated nature and active exploitation of CVE-2026-88771, treat patching exposed appliances as an immediate priority.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
