Patch NetScaler for CVE-2026-88771 and CVE-2026-88772
Citrix reports observed exploitation of two critical flaws in customer-managed NetScaler ADC and Gateway. They have different exposure conditions: CVE-2026-88771 affects all deployments, including default configurations; CVE-2026-88772 requires DTLS to be enabled.
| CVE | Confirmed issue | Exposure condition | Severity |
|---|---|---|---|
CVE-2026-88771 | Unauthenticated remote code execution caused by improper input validation (CWE-20) | All affected ADC and Gateway deployments, including defaults; no additional feature required | CVSS 4.0: 9.5 Critical |
CVE-2026-88772 | Memory overflow with potential remote code execution or denial of service (CWE-119) | DTLS enabled; Citrix says it is enabled by default on VPN virtual servers | CVSS 4.0: 9.5 Critical |
Affected and fixed NetScaler builds
Citrix lists these supported customer-managed product lines as affected below the fixed builds. Upgrade to the fixed version shown or a later release in the same supported track. Secure Private Access Hybrid deployments that use NetScaler instances also need those instances upgraded. Citrix-managed cloud services are updated by Cloud Software Group.
| Product track | Affected versions | Fixed version |
|---|---|---|
| ADC and Gateway 14.1 | Before 14.1-73.37 | 14.1-73.37 or later |
| ADC and Gateway 13.1 | Before 13.1-64.23 | 13.1-64.23 or later |
| ADC FIPS 14.1 | Before 14.1-73.37 FIPS | 14.1-73.37 FIPS or later |
| ADC FIPS / NDcPP 13.1 | Before 13.1-37.279 | 13.1-37.279 or later |
Check DTLS exposure for CVE-2026-88772
CVE-2026-88771 has no configuration-based exclusion: Citrix says all affected deployments are in scope. For CVE-2026-88772, review the running configuration for DTLS-enabled virtual servers. A VPN virtual server without an explicit DTLS-off setting is treated as DTLS enabled; other virtual servers are in scope when configured with type DTLS. Apply Citrix’s full update even if DTLS is disabled, because that setting does not address CVE-2026-88771 or other vulnerabilities in the bulletin.
Triage and response checklist
- Inventory customer-managed ADC, Gateway, and NetScaler instances used by Secure Private Access Hybrid; record each release track and build.
- Prioritize every affected build: CVE-2026-88771 applies without a special feature or non-default configuration.
- Review DTLS-enabled virtual servers to identify the additional CVE-2026-88772 exposure; treat DTLS restrictions only as a temporary compensating measure where service requirements allow.
- Upgrade to the applicable fixed build, then verify the installed version on every appliance and HA peer.
- Because exploitation has been observed, assess appliances for compromise using Citrix’s current Indicators of Compromise guidance and Google Mandiant’s defensive hunting recommendations; patching alone does not establish that an appliance is clean.
- If compromise is suspected, follow your incident-response process and Citrix support guidance before returning the appliance to service.
- Track CVE-2026-88779 separately: it is a distinct SAML-conditioned denial-of-service issue and may require a later build. See the dedicated FlawOpen analysis.