A recently disclosed set of vulnerabilities (CVE-2026-88771 and CVE-2026-88772) affects Citrix NetScaler ADC and Citrix NetScaler Gateway and may allow unauthenticated remote attackers to execute arbitrary code on vulnerable appliances.
Severity level:
CVSS Score: 9.5/Critical.
Description:
CVE-2026-88771 is an improper input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw could allow an unauthenticated attacker to execute arbitrary commands remotely against affected appliances. The vulnerability impacts default NetScaler deployments and does not require any special configuration to be exploitable.
CVE-2026-88772 is a memory overflow vulnerability that may allow remote code execution or denial-of-service attacks. The issue affects systems where DTLS is enabled, which is the default configuration for VPN virtual servers on NetScaler Gateway deployments.
Affected Versions:
- NetScaler ADC and Gateway prior to 14.1-73.37
- NetScaler ADC and Gateway prior to 13.1-64.23
- NetScaler ADC FIPS prior to 14.1-73.37
- NetScaler ADC FIPS and NDcPP prior to 13.1-37.279
Impact:
Successful exploitation may allow attackers to gain unauthorized access to NetScaler infrastructure.
Resolution:
Upgrade immediately to the following fixed versions:-
- NetScaler ADC / Gateway 14.1-73.37 or later
- NetScaler ADC / Gateway 13.1-64.23 or later
- 14.1-73.37 FIPS
- 13.1-37.279 FIPS and NDcPP
Reference:
UIT Information Security