{"uuid": "6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "description": "Description of Problem\n\nMultiple vulnerabilities have been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.\nAffected Versions:\n\nThe following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities:\n\n    Citrix NetScaler ADC and Citrix NetScaler Gateway\u202f14.1\u202fBEFORE 14.1-73.37\n    Citrix NetScaler ADC and Citrix NetScaler Gateway\u202f13.1\u202fBEFORE 13.1-64.23\n    Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS\n    Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279\n\nAdditional Note: Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities.\n\nThis bulletin only applies to customer-managed Citrix NetScaler ADC (\u201cNetScaler ADC\u201d) and Citrix NetScaler Gateway (\u201cNetScaler Gateway\u201d). Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.\n\n| CVE-ID         | Description                                                                                                                                              | Pre-conditions                                                                                                                     | CWE                                                                                       | CVSSv4                                                                                             |\n| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |\n| CVE-2026-88771 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)                       | CWE-20: Improper Input Validation                                                         | CVSS v4.0 Base Score: 9.5<br>(CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)     |\n| CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service                                                                      | DTLS configuration enabled on NetScaler ADC or NetScaler Gateway (Note: Enabled by default on VPN vServer)                         | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer<br><br>  | CVSS v4.0 Base Score: 9.5<br>(CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)     |\n| CVE-2026-88773 | HTTP Request Smuggling                                                                                                                                   | HTTP Configuration enabled on NetScaler ADC or NetScaler Gateway                                                                   | CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | <br>CVSS v4.0 Base Score: 9.3<br>(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N) |\n| CVE-2026-88774 | Feature policy bypass due to improper HTTP URL based expression usage                                                                                    | Any policy expression configured with HTTP URL based expression                                                                    | CWE-16: Configuration                                                                     | CVSS v4.0 Base Score:7<br>(CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N)        |\n| CVE-2026-88775 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service                                                        | NetScaler ADC or NetScaler Gateway configured as either:\u2022 Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)\u2022 AAA virtual server        | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer          | CVSS v4.0 Base Score: 8.8<br>(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N)     |\n| CVE-2026-88776 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service                                                        | Configured as a Load Balancing (LB) virtual server of type Oracle on NetScaler ADC or NetScaler Gateway                            | <br>CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer      | CVSS v4.0 Base Score: 8.8<br>(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N)     |\n| CVE-2026-88777 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service                                                        | Configured as an LB/CS or CGNAT-LSN/NAT64 device with a non-HTTP L7 protocol feature enabled on NetScaler ADC or NetScaler Gateway | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer          | CVSS v4.0 Base Score: 8.8<br>(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N)     |\n| CVE-2026-88778 | TCP Initial Sequence Number (ISN) prediction                                                                                                             | TCP Configuration enabled on NetScaler ADC or NetScaler Gateway                                                                    | CWE-342: Predictable Exact Value from Previous Values                                     | CVSS v4.0 Base Score: 8.8<br>(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L)     |\n\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&amp;articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778", "creation_timestamp": "2026-09-27T15:36:30.408557+00:00", "timestamp": "2026-09-27T15:36:30.408557+00:00", "related_vulnerabilities": ["CVE-2026-88777", "CVE-2026-88774", "CVE-2026-88776", "CVE-2026-88775", "CVE-2026-88771", "CVE-2026-88778", "CVE-2026-88773", "CVE-2026-88772"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}