Affected Systems

Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments. All deployment types affected, including default configurations. CVE-2026-88772 exploitable when DTLS is enabled (default on VPN virtual servers).

Exploitation Status

Active exploitation confirmed by Citrix. Attacks observed against multiple customers worldwide. Exploited as zero-days before patches were available. Law enforcement, CERTs, and national cybersecurity agencies (including Dutch NCSC-NL) warned organizations prior to public disclosure.

Business Impact

NetScaler appliances are typically deployed as Internet-facing edge devices providing remote access and application delivery. Successful exploitation grants attackers initial foothold at network perimeter with potential path to internal systems without endpoint compromise. CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution via improper input validation on all deployments. CVE-2026-88772 (CVSS 9.5) is a memory overflow enabling RCE or DoS when DTLS is enabled. Patching may require downtime for production appliances.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade NetScaler ADC and Gateway appliances to patched versions: 14.1-73.37 or later for 14.1 branch, 13.1-64.23 or later for 13.1 branch, and corresponding FIPS builds per CTX697096
  • If immediate patching is not feasible, consider temporarily shutting down NetScaler appliances until patches can be applied, weighing business continuity against active exploitation risk
  • Review NetScaler appliance logs and network traffic for indicators of compromise, focusing on unusual command execution patterns and memory anomalies around DTLS-enabled VPN virtual servers
  • Inventory all NetScaler deployments including Secure Private Access Hybrid instances to ensure complete coverage of patching efforts
  • Monitor Citrix security bulletin CTX697096 for additional IOCs or mitigation guidance as threat intelligence develops