Citrix NetScaler vulnerabilities were exploited on unmitigated deployments
On September 27, 2026, Citrix published fixes for NetScaler ADC and NetScaler Gateway. CVE-2026-88771 lets an unauthenticated attacker run commands on a default deployment, and Citrix says exploits of that bug and CVE-2026-88772 have been observed.
What was reported
Citrix security bulletin CTX697096, first published September 27, 2026, covers eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. CVE-2026-88771 is improper input validation. Citrix says an unauthenticated attacker can run arbitrary commands, and that every NetScaler ADC and NetScaler Gateway deployment is affected, including the default configuration. Citrix rates it 9.5 on its CVSS 4.0 scale.
CVE-2026-88772 is a memory overflow that can lead to remote code execution or a denial of service when DTLS is enabled. Citrix says DTLS is on by default for a VPN virtual server, and rates this bug 9.5 as well. The bulletin says exploits of CVE-2026-88771 and CVE-2026-88772 have been observed on unmitigated deployments.
The same bulletin lists further bugs, including HTTP request smuggling, that depend on how the appliance is configured. Citrix urges customers to install the fixed builds as soon as possible. Secure Private Access Hybrid deployments that use NetScaler instances need those builds too. The bulletin says it does not apply to Citrix-managed cloud services, which Citrix updates.
How to prevent it
Install the customer-managed builds Citrix lists: NetScaler ADC and Gateway 14.1-73.37 and later, 13.1-64.23 and later releases of 13.1, 14.1-73.37 FIPS and later, and 13.1-37.279 and later for 13.1-FIPS and 13.1-NDcPP. CVE-2026-88771 needs no extra feature, so a customer-managed appliance on an affected build is in scope until it is updated. Citrix says it applies the updates on Citrix-managed cloud services itself.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.