Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-88772

Published 2026-09-27

Updated 26 days ago

Vendor/s

Citrix

Product/s

NetScaler

Version/s

13.1 > 13.1-64.23

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

8.1

/ 10

High

Severity Details

Base score

8.1 High

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

High-severity RCE and DoS vulnerability in Citrix NetScaler ADC and Gateway. Actively exploited and listed on CISA KEV. Patch immediately.

## Why this matters

"CVE-2026-88772 is a high-severity vulnerability affecting Citrix NetScaler ADC and Gateway, capable of leading to Remote Code Execution (RCE) or Denial of Service (DoS). This flaw is particularly critical because it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation by threat actors. As NetScaler devices serve as critical entry points for many corporate networks, a successful exploit could grant attackers deep access or cause significant operational downtime. Security teams must act immediately to secure these edge devices, as they are high-value targets for initial access and lateral movement."

## CPE

Citrix

| Product                                      | Version Start | Version End (excl.) | Status     |
| -------------------------------------------- | ------------- | ------------------- | ---------- |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1-64.23          | vulnerable |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1.37.279         | vulnerable |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1.37.279         | vulnerable |
| netscaler\_application\_delivery\_controller | 14.1          | 14.1-73.37          | vulnerable |
| netscaler\_application\_delivery\_controller | 14.1-66.68    | 14.1-73.37          | vulnerable |
| netscaler\_gateway                           | 13.1          | 13.1-64.23          | vulnerable |
| netscaler\_gateway                           | 14.1          | 14.1-73.37          | vulnerable |

## Related weakness (CWE)

CWE-119

## Remediation plan

1

### Apply official patches

Download and install the latest firmware updates from the Citrix Support portal. Refer to the Citrix Security Bulletin for CVE-2026-88771 through CVE-2026-88778 for comprehensive mitigation guidance.

2

### Update affected systems

Ensure systems are running version 14.1-73.37 or later, or 13.1-64.23 or later. For FIPS or NDcPP deployments, update to version 13.1.37.279 or the equivalent patched release.

3

### Restrict access

Minimize exposure by restricting access to the NetScaler management interface (NSIP) to trusted internal networks only. Use ACLs to limit traffic to Gateway services where possible during the patching window.

4

### Monitor for exploitation

Run the Citrix-provided IOC scripts within the NetScaler console to check for known signs of compromise. Conduct forensic triage as mandated by CISA BOD 26-04 to identify any existing unauthorized access.

## Detection Guidance

"Detecting exploitation of CVE-2026-88772 requires monitoring NetScaler logs for unexpected reboots or segmentation faults. Administrators should utilize the vendor-provided IOC scripts to scan for malicious artifacts on the filesystem. Look for anomalous network traffic patterns targeting the Gateway component and audit management logs for unauthorized configuration changes. Following CISA’s Forensics Triage Requirements is essential for identifying sophisticated persistence mechanisms used by attackers in the wild."

## References

[https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\&articleTitle=Citrix\_NetScaler\_ADC\_and\_Citrix\_NetScaler\_Gateway\_Security\_Bulletin\_for\_CVE\_2026\_88771\_CVE\_2026\_88772\_CVE\_2026\_88773\_CVE\_2026\_88774\_CVE\_2026\_88775\_CVE\_2026\_88776\_CVE\_2026\_88777\_and\_CVE\_2026\_88778 Vendor Advisory ](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-88772 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)