Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
Created on 2026-09-27 15:36, updated on 2026-09-27 15:36, by Alexandre DulaunoyDescription
Description of Problem
Multiple vulnerabilities have been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details. Affected Versions:
The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities:
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23
Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS
Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279
Additional Note: Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities.
This bulletin only applies to customer-managed Citrix NetScaler ADC (“NetScaler ADC”) and Citrix NetScaler Gateway (“NetScaler Gateway”). Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.
| CVE-ID | Description | Pre-conditions | CWE | CVSSv4 |
|---|---|---|---|---|
| CVE-2026-88771 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required) | CWE-20: Improper Input Validation | CVSS v4.0 Base Score: 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) |
| CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | DTLS configuration enabled on NetScaler ADC or NetScaler Gateway (Note: Enabled by default on VPN vServer) | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v4.0 Base Score: 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) |
| CVE-2026-88773 | HTTP Request Smuggling | HTTP Configuration enabled on NetScaler ADC or NetScaler Gateway | CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N) |
| CVE-2026-88774 | Feature policy bypass due to improper HTTP URL based expression usage | Any policy expression configured with HTTP URL based expression | CWE-16: Configuration | CVSS v4.0 Base Score:7 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N) |
| CVE-2026-88775 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | NetScaler ADC or NetScaler Gateway configured as either:• Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)• AAA virtual server | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-88776 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | Configured as a Load Balancing (LB) virtual server of type Oracle on NetScaler ADC or NetScaler Gateway | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v4.0 Base Score: 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-88777 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | Configured as an LB/CS or CGNAT-LSN/NAT64 device with a non-HTTP L7 protocol feature enabled on NetScaler ADC or NetScaler Gateway | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-88778 | TCP Initial Sequence Number (ISN) prediction | TCP Configuration enabled on NetScaler ADC or NetScaler Gateway | CWE-342: Predictable Exact Value from Previous Values | CVSS v4.0 Base Score: 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L) |
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
Vulnerabilities included in this bundle
Combined detection rules
Detection rules are retrieved from Rulezet.
Combined sightings
| Author | Vulnerability | Source | Type | Date |
|---|