--- url: "https://www.xcademia.com/news/citrix-netscaler-security-update-fixes-eight-vulnerabilities-including-two-exploited-rce-flaws" title: "Citrix NetScaler Security Update Fixes Eight Vulnerabilities, Including Two Exploited RCE Flaws" description: "Citrix has disclosed eight NetScaler vulnerabilities, including two exploited RCE flaws. See affected versions, CVSS scores and fixes." publishedAt: "2026-09-28T07:09:19.713+00:00" updatedAt: "2026-10-09T06:17:04.670415+00:00" type: news category: cybersecurity source_name: "Citrix - Citrix Knowledge Center" source_url: "https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html?" tags: - "#Citrix" - "#NetScaler" - "#NetScalerADC" - "#Cybersecurity" - "#RemoteCodeExecution" - "#ZeroDay" - "#VulnerabilityManagement" - "#CVE" --- # Citrix NetScaler Security Update Fixes Eight Vulnerabilities, Including Two Exploited RCE Flaws > Citrix has disclosed eight NetScaler ADC and Gateway vulnerabilities, including two critical remote code execution flaws that have been exploited on unmitigated deployments. Customers are urged to upgrade to fixed builds. Source: **Citrix - Citrix Knowledge Center** · 28 September 2026 Citrix has disclosed eight vulnerabilities affecting **NetScaler ADC and NetScaler Gateway**, including two critical remote code execution vulnerabilities that the company says have already been exploited on unmitigated deployments. The security bulletin, identified as **CTX697096**, covers vulnerabilities ranging from remote code execution and memory overflow issues to HTTP request smuggling, policy bypass, denial of service, and TCP Initial Sequence Number prediction. Citrix says affected customers should install the relevant updated NetScaler versions as soon as possible. The bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway deployments. Citrix-managed cloud services are handled separately by Cloud Software Group. The bulletin was initially published on September 27, 2026. ## Two NetScaler RCE vulnerabilities are being exploited The two vulnerabilities receiving the most immediate attention are **CVE-2026-88771** and **CVE-2026-88772**. Citrix states that exploitation of both vulnerabilities has been observed on unmitigated NetScaler deployments. ### CVE-2026-88771 CVE-2026-88771 is a **remote code execution vulnerability caused by improper input validation**. Citrix assigns the vulnerability a **CVSS v4.0 base score of 9.5** and says an unauthenticated attacker can execute arbitrary commands. Importantly, Citrix lists the precondition as **all NetScaler ADC and NetScaler Gateway deployments**, including default configurations. No additional feature or configuration is required for the vulnerability to apply. The issue is classified under **CWE-20: Improper Input Validation**. ### CVE-2026-88772 CVE-2026-88772 is a **memory overflow vulnerability** that can lead to remote code execution or denial of service. It also carries a **CVSS v4.0 base score of 9.5**. The vulnerability requires **DTLS to be enabled** on the affected NetScaler deployment. Citrix notes that DTLS is enabled by default on a VPN virtual server unless it is explicitly disabled. The issue is classified as **CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer**. ### Why these two flaws matter The combination of unauthenticated remote code execution and observed exploitation makes these vulnerabilities particularly important for organisations operating internet-facing NetScaler infrastructure. For CVE-2026-88771, Citrix specifically states that default configurations are affected. This means administrators cannot rely on having avoided optional features as a reason to consider the appliance unaffected. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790588359760-info1--97-.webp) ## Eight vulnerabilities affect different NetScaler configurations The Citrix bulletin covers eight separate CVEs. CVE Issue CVSS v4.0 Key precondition CVE-2026-88771 Unauthenticated remote code execution 9.5 All NetScaler ADC and Gateway deployments CVE-2026-88772 Memory overflow leading to RCE or DoS 9.5 DTLS enabled CVE-2026-88773 HTTP request smuggling 9.3 HTTP configuration enabled CVE-2026-88774 Feature policy bypass 7.0 HTTP URL-based policy expression CVE-2026-88775 Memory overflow causing unpredictable behaviour or DoS 8.8 Gateway or AAA virtual server CVE-2026-88776 Memory overflow causing unpredictable behaviour or DoS 8.8 Oracle load-balancing virtual server CVE-2026-88777 Memory overflow causing unpredictable behaviour or DoS 8.8 Non-HTTP Layer 7 protocol feature CVE-2026-88778 TCP Initial Sequence Number prediction 8.8 TCP configuration with Enhanced ISN Generation disabled These classifications and scores are taken directly from Citrix's advisory. ## CVE-2026-88773 introduces an HTTP request smuggling risk The third-highest-scoring vulnerability is **CVE-2026-88773**, an HTTP request smuggling vulnerability with a **CVSS v4.0 score of 9.3**. Citrix identifies the issue as **CWE-444**, which covers inconsistent interpretation of HTTP requests. The relevant precondition is that HTTP configuration is enabled on NetScaler ADC or NetScaler Gateway. Citrix says administrators can check for HTTP or SSL virtual servers associated with Load Balancing, Content Switching, VPN, or Authentication configurations. HTTP request smuggling can be particularly relevant to infrastructure that processes requests through multiple HTTP-aware components, although the Citrix bulletin does not provide additional details about exploitation scenarios. ## Policy bypass and memory overflow vulnerabilities **CVE-2026-88774** has a CVSS v4.0 score of **7.0** and involves a feature policy bypass caused by improper use of HTTP URL-based expressions. Citrix lists **CWE-16: Configuration** for the vulnerability. The remaining three memory overflow vulnerabilities, CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777, each have a **CVSS v4.0 score of 8.8**. Their exposure depends on specific NetScaler configurations. CVE-2026-88775 applies to NetScaler configured as a Gateway or AAA virtual server. CVE-2026-88776 applies when NetScaler is configured as an Oracle load-balancing virtual server. CVE-2026-88777 applies to certain LB, Content Switching, CGNAT-LSN or NAT64 configurations where non-HTTP Layer 7 protocol functionality is enabled. Citrix provides configuration patterns administrators can use to determine whether these conditions apply to their appliances. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790588380236-info2--4-.png) ## CVE-2026-88778 involves TCP ISN prediction The eighth vulnerability, **CVE-2026-88778**, concerns prediction of the **TCP Initial Sequence Number (ISN)**. Citrix assigns this vulnerability a **CVSS v4.0 score of 8.8** and classifies it as **CWE-342: Predictable Exact Value from Previous Values**. Citrix says administrators should verify two conditions: 1. At least one virtual server is configured with one of the listed supported protocol types. 2. The NetScaler setting reports **Enhanced ISN Generation: DISABLED**. Administrators can check the relevant setting using: `show ns tcpparam | grep "Enhanced ISN Generation"` Citrix separately instructs deployments affected by CVE-2026-88778 to apply the TCP configuration change described in its NetScaler documentation. ## Which NetScaler versions are affected? Citrix lists the following supported versions as affected: - NetScaler ADC and NetScaler Gateway **14.1 before 14.1-73.37** - NetScaler ADC and NetScaler Gateway **13.1 before 13.1-64.23** - NetScaler ADC FIPS **before 14.1-73.37 FIPS** - NetScaler ADC FIPS and NDcPP **before 13.1-37.279** Citrix also states that Secure Private Access Hybrid deployments using NetScaler instances are affected and should be upgraded to the recommended builds. ## Citrix's recommended remediation Citrix recommends that affected customers install the relevant updated versions as soon as possible. The listed fixed releases are: - **14.1-73.37 and later** - **13.1-64.23 and later** - **14.1-73.37 FIPS and later** for 14.1-FIPS - **13.1-37.279 and later** for 13.1-FIPS and 13.1-NDcPP The bulletin specifically identifies CVE-2026-88771 and CVE-2026-88772 as vulnerabilities for which exploitation has been observed. For CVE-2026-88778, Citrix additionally recommends applying the relevant TCP configuration change. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790588403912-info3--97-.webp) ## How administrators can check exposure The bulletin contains specific checks for each vulnerability. For **CVE-2026-88771**, every NetScaler ADC and NetScaler Gateway deployment is considered affected under Citrix's stated precondition. For **CVE-2026-88772**, administrators should inspect virtual servers for DTLS configuration. Citrix notes that VPN virtual servers are vulnerable if DTLS has not been explicitly disabled. For **CVE-2026-88773**, administrators should review HTTP and SSL virtual servers used for Load Balancing, Content Switching, VPN and Authentication. For **CVE-2026-88775**, the relevant configuration is Gateway or AAA virtual servers. For **CVE-2026-88776**, administrators should check for Oracle load-balancing virtual servers. For **CVE-2026-88777**, Citrix provides configuration-text patterns covering functionality such as FTP, RTSP, DNS64 and NAT64. For **CVE-2026-88778**, administrators can check the virtual-server configuration and the Enhanced ISN Generation setting. The bulletin provides the detailed configuration patterns and commands needed for these checks. ## What organisations should consider For organisations operating customer-managed NetScaler infrastructure, the bulletin creates several practical priorities. First, administrators should establish whether they operate affected NetScaler versions. Second, the organisation should identify whether the appliance is exposed to the specific configuration-dependent vulnerabilities. Third, affected systems should be upgraded to the versions specified by Citrix. Finally, administrators should review the configuration-specific guidance for CVE-2026-88778 and other vulnerabilities where Citrix provides additional checks. The immediate remediation priority is reinforced by Citrix's statement that exploitation of CVE-2026-88771 and CVE-2026-88772 has already been observed. The bulletin does not provide information about the number of affected organisations, the identities of attackers, the scale of exploitation, or specific compromises resulting from the observed attacks. ## Customer-managed versus Citrix-managed services The advisory applies specifically to **customer-managed Citrix NetScaler ADC and NetScaler Gateway** installations. Citrix states that Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates. This distinction matters because administrators of customer-managed appliances have direct responsibility for applying the recommended NetScaler builds. ## Security researchers acknowledged by Citrix Citrix credited **Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, along with Maxim Suhanov**, for working with the company to protect customers. The bulletin does not provide additional details about the individual vulnerability discovery timelines or the specific research contributions of each person. ## The broader security context The NetScaler bulletin highlights the security risks associated with internet-facing application delivery and remote access infrastructure. The eight vulnerabilities do not share a single technical root cause. Instead, they cover several classes of security weaknesses, including input validation, memory safety, HTTP request handling, configuration policy, and TCP behaviour. For security teams, this means vulnerability management cannot rely solely on version numbers. Configuration and enabled functionality can also determine exposure for several of the vulnerabilities covered by the advisory. This is particularly relevant for appliances that provide multiple network and application delivery functions from a single platform. ## Bottom line Citrix's September 27 security bulletin covers **eight vulnerabilities in NetScaler ADC and NetScaler Gateway**, with CVSS v4.0 scores ranging from **7.0 to 9.5**. The two most critical issues, **CVE-2026-88771 and CVE-2026-88772**, both have CVSS v4.0 scores of 9.5, and Citrix says exploitation has been observed against unmitigated deployments. CVE-2026-88771 affects all NetScaler ADC and Gateway deployments under the bulletin's stated precondition, while CVE-2026-88772 requires DTLS to be enabled. Citrix recommends upgrading affected appliances to the specified fixed releases and applying the additional TCP configuration change where CVE-2026-88778 applies. Organisations running customer-managed NetScaler infrastructure should therefore review their appliance versions and configurations against the official Citrix bulletin. ## Original source https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html? ## Tags `#Citrix` · `#NetScaler` · `#NetScalerADC` · `#Cybersecurity` · `#RemoteCodeExecution` · `#ZeroDay` · `#VulnerabilityManagement` · `#CVE` --- ## About this content This Markdown news article is the citation-grade twin of [Citrix NetScaler Security Update Fixes Eight Vulnerabilities, Including Two Exploited RCE Flaws](https://www.xcademia.com/news/citrix-netscaler-security-update-fixes-eight-vulnerabilities-including-two-exploited-rce-flaws). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/citrix-netscaler-security-update-fixes-eight-vulnerabilities-including-two-exploited-rce-flaws - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt