NetScaler ADC flaws exploited in the wild
Citrix NetScaler ADC/Gateway have two actively exploited vulnerabilities (CVE-2026-88771, CVE-2026-88772) allowing remote code execution or DoS; patch immediately.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-88771 and CVE-2026-88772 as exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an advisory covering eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (formerly Citrix ADC/Gateway) appliances. Two of these, CVE-2026-88771 and CVE-2026-88772, are confirmed to be under active exploitation in the wild, with CISA reporting threat actors globally are actively abusing them. Successful exploitation can allow a remote unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. CVE-2026-88772 requires DTLS to be enabled, which is the default configuration for VPN virtual servers, broadening its practical exposure.
Affected versions span the 14.1 branch prior to 14.1-73.37, the 13.1 branch prior to 13.1-64.23, and corresponding FIPS/NDcPP builds. Citrix has released fixed versions for all affected branches and is providing Indicators of Compromise via NetScaler Console, along with guidance on checking whether a given deployment meets the vulnerable conditions.
Given the confirmed active exploitation, widespread deployment of NetScaler appliances as internet-facing VPN/ADC gateways, and the severity of potential impact (RCE/DoS), defenders should treat this as an urgent patching priority. Organizations should apply the vendor-supplied fixed builds immediately, review NetScaler Console for provided IOCs, and verify DTLS configuration status on VPN virtual servers as part of exposure assessment.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260928.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs