Search threats, CVEs… ⌘K
Back to vendor advisories
Citrix Security BulletinsCTX697096

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities identified below

Read the vendor bulletin Get alerts for NetScaler ADC and Citrix NetScaler Gateway
9.5CVSS out of 10Critical severity
Scope

What the vendor says is affected

  • Citrix NetScaler ADC and Citrix NetScaler Gateway
  • The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities: Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279

Versions the vendor lists as fixed

  • Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
  • Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
  • Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
  • Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP
Next step

What the vendor recommends

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1 Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation

Review the complete instructions on the vendor's site
Timeline

When this advisory changed

  1. Published by Citrix

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-88771View CVSS, KEV, EPSS, and threat contextCVE-2026-88772View CVSS, KEV, EPSS, and threat contextCVE-2026-88773View CVSS, KEV, EPSS, and threat contextCVE-2026-88774View CVSS, KEV, EPSS, and threat contextCVE-2026-88775View CVSS, KEV, EPSS, and threat contextCVE-2026-88776View CVSS, KEV, EPSS, and threat contextCVE-2026-88777View CVSS, KEV, EPSS, and threat contextCVE-2026-88778View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor