CVE-2026-88772: Citrix NetScaler Vulnerability
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-09-27. Federal agencies must patch by 2026-09-30.
TL;DR - CVE-2026-88772 can enable remote code execution or denial of service in Citrix NetScaler ADC and Gateway. - Affected 14.1, 13.1, FIPS, and NDcPP builds require upgrades to fixed versions. - CISA confirms exploitation in the wild. Treat exposed appliances as an emergency remediation priority.
CVE-2026-88772 summary
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-88772 |
| CVSS base score | 8.1 |
| CVSS vector | Not returned in the NVD record reviewed |
| Attack vector | Not fully specified in the available record; affected appliances commonly provide internet-facing services |
| Authentication required | Not stated in the available source material |
| Patch available | Yes |
| CISA KEV | Yes; added September 27, 2026 |
| Exploitation status | Confirmed in the wild by CISA |
| Public PoC | No verified public proof of concept identified in the reviewed sources |
CVE-2026-88772 is an improper restriction of operations within the bounds of a memory buffer vulnerability affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. NVD describes the consequences as remote code execution or denial of service. The issue has a reported CVSS base score of 8.1, but the complete CVSS vector was not returned in the NVD record reviewed here. Defenders should not infer missing score components.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a September 30, 2026 remediation due date. That designation is the key operational fact: exploitation is confirmed, even though no verified public proof-of-concept repository was identified in the available research. Internet exposure, appliance role, and the potential for code execution make unpatched systems high-priority targets.
For comparison, organizations tracking other actively exploited vulnerabilities can also review the CVE-2026-14807 vulnerability advisory.
Analyst’s Take: Start with internet-facing appliances, especially those with DTLS enabled and those supporting remote access. The lack of a verified public PoC or complete CVSS vector does not offset CISA’s confirmation of exploitation. Upgrade first, then investigate the appliance and its management plane for signs of compromise.
Root cause
CISA classifies the issue as an improper restriction of operations within the bounds of a memory buffer. In practical terms, a vulnerable code path does not adequately constrain memory operations, creating conditions that may be abused to corrupt memory or otherwise disrupt normal execution. NVD associates the vulnerability with remote code execution and denial of service.
Available technical reporting indicates that the DTLS feature must be enabled for exploitation. The same reporting describes exploitation as technically difficult or high-complexity. Those conditions can inform prioritization and threat hunting, but they are not a reason to defer remediation. A vulnerable edge appliance may expose authentication, remote access, proxy, and traffic-handling functions to untrusted networks.
The available sources do not provide enough verified detail to identify the vulnerable function, a reliable exploit payload, or a complete protocol-level detection signature. Administrators should not treat the absence of a known exploit string as evidence that an appliance is safe.
Who is exposed?
The affected standard NetScaler ADC and NetScaler Gateway releases are:
| Product or edition | Affected versions | Fixed version |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | Before 14.1-73.37 | 14.1-73.37 and later |
| NetScaler ADC and Gateway 13.1 | Before 13.1-64.23 | 13.1-64.23 and later 13.1 releases |
| NetScaler ADC 14.1 FIPS | Before 14.1-73.37 FIPS | 14.1-73.37 FIPS and later |
| NetScaler ADC 13.1 FIPS | Before 13.1.37.279 | 13.1.37.279 and later |
| NetScaler ADC 13.1 NDcPP | Before 13.1.37.279 | 13.1.37.279 and later |
Citrix Secure Private Access Hybrid deployments that use NetScaler instances are also reportedly affected. Inventory must include appliances managed by separate teams, deployed in cloud or hybrid architectures, or used as part of remote-access services rather than traditional ADC workloads.
The research material does not identify other NetScaler release branches as affected or provide a safe assumption for unsupported versions. Organizations running a release outside the listed branches should consult the Citrix bulletin directly and avoid assuming that an unlisted version is unaffected.
Any appliance with DTLS enabled deserves immediate review, particularly when it is reachable from the internet.
Severity breakdown
The reported NVD CVSS base score is 8.1, placing the vulnerability in the high-severity range. The supplied NVD record did not return the CVSS vector, so the individual values for attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability cannot be stated reliably.
Third-party reporting indicates that exploitation may require DTLS to be enabled and may involve high attack complexity. These observations should not be converted into an assumed CVSS vector. They do, however, help defenders identify higher-risk deployments: internet-facing appliances with DTLS enabled and systems supporting remote access should be patched and investigated first.
The potential impact is substantial. Successful exploitation may result in remote code execution, while unsuccessful or disruptive exploitation may cause denial of service on a network-edge appliance. CISA’s KEV status should outweigh uncertainty about individual CVSS components when setting remediation deadlines.
Exploitation status
In-the-wild exploitation is confirmed by CISA. CVE-2026-88772 is listed in the CISA Known Exploited Vulnerabilities catalog, with a date added of September 27, 2026. Organizations should assume that exposed appliances may have been scanned, probed, or attacked even if they have not observed an obvious outage.
No verified public proof-of-concept repository was identified in the reviewed sources. CISA records known ransomware campaign use as unknown; there is no basis in the supplied material to claim ransomware association. The absence of a public PoC does not reduce the urgency because KEV inclusion indicates that exploitation has already been observed by authoritative vulnerability-response sources.
Sources
The primary references for this vulnerability are the NVD record, the Citrix security bulletin, and the CISA KEV catalog:
Additional technical reporting reviewed for exploitation conditions and defensive context includes Rapid7’s analysis, the watchTowr technical FAQ, and the Bitsight exploitation alert.
The Citrix advisory was not fully rendered in the retrieval used for this analysis, so version and fixed-build details should be verified against the live official bulletin before maintenance.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection guidance
Begin with asset discovery and exposure validation. Enumerate all NetScaler ADC and Gateway appliances, record their exact build, identify internet-facing interfaces, and determine whether DTLS is enabled. Include appliances used by Secure Private Access Hybrid deployments and any systems managed through a separate cloud or networking team.
Review authentication events, administrative activity, configuration changes, unexpected service behavior, process or file changes, and outbound connections. A universal exploit signature is not available from the supplied sources, so detection should focus on anomalous activity around the appliance and its management plane.
Technical notes
The following is a generic triage filter for exported appliance or SIEM logs. Field names and log locations vary by deployment, so validate it against the organization’s logging format. It is a hunting heuristic, not a CVE-specific exploit signature:
grep -Ein \
'login|authentication|admin|user|config|save ns config|set ssl|add .*user|shell|exec|process|error|crash|restart|DTLS' \
netscaler-exported-logs.txt
A SIEM query can correlate administrative activity with appliance restarts, crashes, configuration saves, and unusual outbound traffic. For example, in a schema with normalized fields, use a query pattern like:
device_type="netscaler"
| where timestamp >= now()-30d
| where event_type in ("authentication", "configuration_change", "process", "service", "crash")
| stats count, values(action), values(src_ip), values(user)
by host, event_type, bin(timestamp, 15m)
| sort - timestamp
Investigate results rather than treating every match as malicious. Preserve relevant logs before rotating or rebuilding an appliance, and compare current configuration with known-good baselines. Network monitoring should look for unexpected outbound connections from the appliance, unusual management access, and DTLS-related activity that does not match the appliance’s normal role.
Remediation steps
Upgrade every affected appliance to the appropriate fixed build:
- NetScaler ADC or Gateway 14.1-73.37 or later
- NetScaler ADC or Gateway 13.1-64.23 or later
- NetScaler ADC 14.1-73.37 FIPS or later
- NetScaler ADC 13.1.37.279 FIPS or later
- NetScaler ADC 13.1.37.279 NDcPP or later
Use Citrix’s official CTX697096 bulletin and official download channels to select the correct image for the appliance edition. Do not substitute a standard build for a FIPS or NDcPP deployment. Schedule the upgrade with appropriate failover and rollback planning, but prioritize internet-facing systems ahead of lower-risk internal appliances.
If an immediate upgrade is impossible, follow the mitigation procedure in the Citrix bulletin. Available reporting indicates that exploitation requires DTLS to be enabled, so disabling DTLS may reduce exposure where the feature is not operationally required. Treat this as a temporary, validated workaround rather than a replacement for upgrading. The exact configuration syntax depends on the NetScaler release and deployment, so administrators should use Citrix’s documented procedure rather than apply an unverified command.
Organizations should also rotate exposed administrative credentials after collecting evidence and reviewing access logs. A reputable password manager such as Try 1Password → can help teams generate and store unique administrator credentials, but credential management does not replace patching or incident investigation.
Technical notes
Use the NetScaler CLI to confirm the installed build before and after maintenance:
show ns version
Record the complete version and edition output. A system is not remediated merely because it has been rebooted or because its major branch is 13.1 or 14.1; it must meet the specific fixed-build threshold above. After upgrading, verify that the expected build is running, confirm service health, and recheck DTLS and remote-access configuration.
If compromise is suspected, do not immediately erase or rebuild the appliance before collecting available evidence. Preserve logs, configuration snapshots, authentication records, and relevant network telemetry. Isolate or restrict an appliance when necessary to prevent continued exposure, while maintaining a controlled path for forensic collection and business continuity.
If a workaround is used while waiting for maintenance, document its owner, scope, validation steps, and removal date. See this overview of what an out-of-band patch is for context on emergency remediation decisions.