Citrix has issued emergency updates for its NetScaler ADC and NetScaler Gateway products. The security patches address two critical remote code execution (RCE) vulnerabilities that have been actively exploited by attackers. These vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, pose significant risks, allowing remote attackers to execute arbitrary code on unprotected systems.
Urgent Security Patches Released
The vulnerabilities have been assigned a CVSS v4.0 score of 9.5, highlighting their severity. These flaws enable unauthenticated remote attackers to perform malicious activities, making any internet-facing gateways particularly vulnerable. The critical nature of these vulnerabilities demands immediate attention from system administrators to prevent potential breaches.
Citrix’s confirmation follows reports by Cyber Security News and watchTowr, which previously identified these zero-day vulnerabilities during forensic examinations. Initially, Citrix had not provided detailed information or mitigation measures, forcing some organizations to isolate their vulnerable systems while awaiting official guidance.
Details of the Vulnerabilities
CVE-2026-88771 arises from improper input validation, affecting all NetScaler ADC and Gateway deployments, including those with default configurations. This wide-ranging exposure necessitates urgent patching to mitigate the risk of arbitrary command execution.
CVE-2026-88772 is a memory overflow issue that can result in either remote code execution or denial of service, particularly when DTLS is enabled by default on VPN virtual servers. Citrix’s bulletin also addresses six other vulnerabilities, including CVE-2026-88773, which involves HTTP request smuggling, and several memory overflow issues affecting various virtual servers.
Recommended Actions and Future Outlook
Administrators are advised to upgrade to NetScaler ADC and Gateway versions 14.1-73.37 or later, or 13.1-64.23 or later, to secure their systems. Specialized builds for FIPS and NDcPP deployments are also available, ensuring comprehensive protection across different configurations.
Given the confirmed exploitation of these vulnerabilities, organizations should prioritize these updates as a critical incident response rather than routine maintenance. It is crucial to inspect existing configurations, check for signs of compromise, and engage qualified forensic responders if suspicious activity is detected.
While applying the updates will address the vulnerabilities, it is important to remain vigilant as attackers may have left behind persistent threats or artifacts. Continuous monitoring and external log analysis are recommended to maintain a secure network environment.
