Affected Systems

Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions). CVE-2026-88772 affects systems with DTLS enabled (default on VPN vServer). Six additional vulnerabilities (CVE-2026-88773 through CVE-2026-88778) with varying configuration prerequisites. Customer-managed and Secure Private Access Hybrid deployments impacted.

Exploitation Status

Active exploitation confirmed in the wild for CVE-2026-88771 (CVSS 9.5, unauthenticated RCE via improper input validation) and CVE-2026-88772 (CVSS 9.5, memory overflow RCE/DoS). Citrix has publicly confirmed ongoing attacks targeting both critical vulnerabilities.

Business Impact

Internet-facing NetScaler ADC and Gateway appliances are at immediate risk of full compromise. CVE-2026-88771 requires no preconditions, enabling trivial exploitation of all exposed instances. Organizations using NetScaler for VPN, load balancing, or application delivery are vulnerable to pre-authentication remote code execution, data exfiltration, lateral movement, and service disruption. Six additional vulnerabilities (CVSS 7.0-9.3) increase attack surface for HTTP request smuggling, policy bypass, and denial of service depending on configuration.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all customer-managed NetScaler ADC and Gateway appliances to version 13.1-64.23, 14.1-73.37, or 13.1-37.279 (FIPS/NDcPP) per Citrix CTX697096
  • Conduct forensic compromise assessment on all internet-facing NetScaler instances running affected builds, focusing on indicators of CVE-2026-88771 and CVE-2026-88772 exploitation
  • Enable Enhanced ISN Generation on all deployments with TCP configurations enabled per Citrix documentation
  • Review and validate HTTP URL-based policy expressions to assess exposure to CVE-2026-88773 (request smuggling) and CVE-2026-88774 (policy bypass)
  • If immediate patching is not feasible, isolate affected appliances from internet exposure and implement compensating network controls until remediation is complete