cyber.hendryadrian.com
Vulnerability & Exploit · ncsc.gov.uk

Two Actively Exploited Vulnerabilities Affect Citrix NetScaler ADC and Gateway

· Original article ↗

Summary

The NCSC warns that two of eight vulnerabilities affecting on-premises Citrix NetScaler ADC and Gateway are actively exploited. It urges affected organisations to check exposure, investigate for compromise, isolate systems where possible and install updates.

Key points

  • Citrix disclosed eight vulnerabilities affecting on-premises NetScaler ADC and NetScaler Gateway; the NCSC is assessing the potential impact on UK organisations.
  • CVE-2026-88771 allows unauthenticated remote command execution; CVE-2026-88772 can enable remote code execution or denial of service. Both are confirmed actively exploited.
  • Other flaws include HTTP request/response smuggling, a feature policy bypass, memory overflows and a predictable-value vulnerability that may affect integrity or availability.
  • Affected supported versions include ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, as well as specified FIPS and NDcPP releases.
  • The NCSC advises checking Citrix's bulletin and IoCs, isolating affected systems where possible, investigating for compromise, and installing the latest available updates.
  • Organisations should continue monitoring the bulletin and threat hunting; isolation or replacement may cause service outages.

Article Details

Vulnerability Types
  • Improper input validation allowing unauthenticated remote command execution
  • Improper restriction of operations within a memory buffer, potentially causing remote code execution or denial of service
  • HTTP request/response smuggling
  • HTTP URL-based expression misuse causing a feature policy bypass
  • Memory overflow potentially causing unpredictable behavior or denial of service
  • Predictable exact value vulnerability potentially affecting integrity or availability
Affected Versions
  • Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 before 14.1-73.37
  • Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 before 13.1-64.23
  • Citrix NetScaler ADC FIPS before 14.1-73.37 FIPS
  • Citrix NetScaler ADC FIPS and NDcPP before 13.1-37.279
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Where possible, isolate affected systems, such as by temporarily disabling service access with upstream firewalls, disabling vulnerable components, or restricting access to the organisation's IP range.

CVE

CVE-2026-88771eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being actively exploited.CVE-2026-88772affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being actively exploited.CVE-2026-88773CVE-2026-88773: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling), which may allow an attacker to manipulate or bypass security controls.CVE-2026-88774CVE-2026-88774: Improper HTTP URL-based expression usage leading to a feature policy bypass.CVE-2026-88775CVE-2026-88775: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.CVE-2026-88776CVE-2026-88776: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.CVE-2026-88777CVE-2026-88777: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.CVE-2026-88778CVE-2026-88778: Predictable exact value vulnerability that may allow an attacker to influence integrity or availability.

Vendors

CitrixCitrix has published a security bulletin detailing eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being

Products

Citrix NetScaler ADC FIPSCitrix NetScaler ADC FIPS before 14.1-73.37 FIPSCitrix NetScaler Gatewaypublished a security bulletin detailing eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being activelyNetScaler ADCCitrix has published a security bulletin detailing eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as beingNetScaler Console File Integrity Monitoringbulletin and perform continuous threat hunting activities. Customers can also use NetScaler Console File Integrity Monitoring to help detect unauthorised or unexpected changes to monitored files on managed

Related Articles