CVE-2026-88772
Description
High-severity RCE and DoS vulnerability in Citrix NetScaler ADC and Gateway. Actively exploited and listed on CISA KEV. Patch immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| netscaler_application_delivery_controller | 13.1 | 13.1-64.23 | vulnerable |
| netscaler_application_delivery_controller | 13.1 | 13.1.37.279 | vulnerable |
| netscaler_application_delivery_controller | 13.1 | 13.1.37.279 | vulnerable |
| netscaler_application_delivery_controller | 14.1 | 14.1-73.37 | vulnerable |
| netscaler_application_delivery_controller | 14.1-66.68 | 14.1-73.37 | vulnerable |
| netscaler_gateway | 13.1 | 13.1-64.23 | vulnerable |
| netscaler_gateway | 14.1 | 14.1-73.37 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest firmware updates from the Citrix Support portal. Refer to the Citrix Security Bulletin for CVE-2026-88771 through CVE-2026-88778 for comprehensive mitigation guidance.
Update affected systems
Ensure systems are running version 14.1-73.37 or later, or 13.1-64.23 or later. For FIPS or NDcPP deployments, update to version 13.1.37.279 or the equivalent patched release.
Restrict access
Minimize exposure by restricting access to the NetScaler management interface (NSIP) to trusted internal networks only. Use ACLs to limit traffic to Gateway services where possible during the patching window.
Monitor for exploitation
Run the Citrix-provided IOC scripts within the NetScaler console to check for known signs of compromise. Conduct forensic triage as mandated by CISA BOD 26-04 to identify any existing unauthorized access.
Detection Guidance
"Detecting exploitation of CVE-2026-88772 requires monitoring NetScaler logs for unexpected reboots or segmentation faults. Administrators should utilize the vendor-provided IOC scripts to scan for malicious artifacts on the filesystem. Look for anomalous network traffic patterns targeting the Gateway component and audit management logs for unauthorized configuration changes. Following CISA’s Forensics Triage Requirements is essential for identifying sophisticated persistence mechanisms used by attackers in the wild."