Citrix NetScaler flaws exploited for RCE
Two actively exploited NetScaler ADC/Gateway vulnerabilities allow unauthenticated remote code execution; patch immediately.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-88771 and CVE-2026-88772 as exploited in the wild.
CIS/MS-ISAC has issued an advisory covering eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, the most severe of which enable unauthenticated remote code execution. CVE-2026-88771 is an unauthenticated RCE affecting all NetScaler ADC/Gateway deployments by default, requiring no additional configuration. CVE-2026-88772 is a memory overflow vulnerability leading to RCE or DoS on deployments with DTLS enabled (the default on VPN virtual servers). Both are confirmed as actively exploited in the wild. The remaining six vulnerabilities include HTTP request smuggling, policy bypass, multiple memory overflow/DoS conditions affecting Gateway, Load Balancing (Oracle-type), and CGNAT-LSN/NAT64 deployments, and a TCP ISN prediction issue.
Affected versions span NetScaler ADC/Gateway 14.1 prior to 14.1-73.37, 13.1 prior to 13.1-64.23, and corresponding FIPS/NDcPP builds. Given the widespread default exposure of CVE-2026-88771 and confirmed in-the-wild exploitation, this represents a high-urgency patching priority for organizations running internet-facing NetScaler appliances, which are commonly used for VPN/SSO access and application delivery. Defenders should prioritize immediate patching to the fixed versions, review exposure of DTLS-enabled VPN virtual servers, and apply network segmentation and vulnerability scanning as compensating controls while patches are validated.
No threat actor attribution, malware families, or specific IOCs were provided in this advisory. The advisory maps to MITRE ATT&CK's Exploit Public-Facing Application technique under Initial Access, consistent with prior NetScaler exploitation patterns seen in the wild against edge/remote-access infrastructure.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-netscaler-adc-and-netscaler-gateway-could-allow-for-remote-code-execution_2026-103
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs