cyfenced.com →

[ CVE-2026-88772 · Published 27 Sep 2026 ]

Memory flaw in NetScaler ADC and Gateway allows remote code execution

Exploited · CISA KEV CVSS 8.1 EPSS 1%5 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-27
  • Urgent advisory from CERT-EU, CERT-FR, NCSC-NL

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and it needs no credentials or user action, although the attack is harder to pull off than CVE-2026-88771.

Red alert if
You run NetScaler ADC or NetScaler Gateway on a version older than the fixed builds and it is reachable from the internet.
Can wait if
You do not use NetScaler, or you already run the fixed builds.
What it is
A memory buffer flaw in Citrix NetScaler ADC and NetScaler Gateway can lead to remote code execution or a denial of service. It affects the same versions as CVE-2026-88771: builds before 14.1-73.37 and 13.1-64.23, and the matching FIPS and NDcPP builds.
Impact
An unauthenticated attacker on the network can crash the appliance or, under harder conditions, run code on it. For a business this means either an outage of remote access and load balancing, or an attacker in control of an edge device that sees user sessions and credentials.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted traffic to the NetScaler service exposed to the internet.
  2. T1059.004 Command and Scripting Interpreter: Unix ShellSuccessful exploitation gives them code execution on the appliance's operating system.
  3. T1499 Endpoint Denial of ServiceA failed or deliberate attempt can crash the appliance and cut off remote access.
  4. T1078 Valid AccountsCredentials or sessions taken from the gateway are reused against internal systems.

What to do

  1. Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 or later, following Citrix bulletin CTX697096. The same upgrade fixes CVE-2026-88771. Go straight to 14.1-73.41 or 13.1-64.28 if you can: those builds also fix the exploited denial of service flaw CVE-2026-88779.
  2. Restrict who can reach the appliance's interfaces until the upgrade is done.
  3. Check the appliance for signs of compromise using Citrix's guidance and the indicators it publishes.
  4. If you find signs of compromise, reset credentials and end active sessions that used the gateway.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

CISA: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 30 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References