BREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)

Citrix published security bulletin CTX697096 on 2026-09-27 for eight NetScaler ADC / NetScaler Gateway flaws. The lead issue is CVE-2026-88771: unauthenticated remote code execution from improper input validation on every customer-managed NetScaler ADC and Gateway deployment, including default configuration. No extra feature has to be turned on. Citrix rates it CVSS v4.0 9.5 and states that exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments have been observed. Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS/NDcPP. This is the operator write-up from CTX697096 and the CVE AWG records. The HOL Guard evidence pack for the lead CVE is at /guard/security/cves/CVE-2026-88771.

Who is not in scope

Skip the pager only if one of these is true:

• Cloud Software Group already runs the appliance for you. CTX697096 applies to customer-managed NetScaler ADC and NetScaler Gateway only. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by CSG.
• Every customer-managed ADC/Gateway instance you own is already on 14.1-73.37+, 13.1-64.23+, 14.1-73.37 FIPS+, or 13.1.37.279 FIPS/NDcPP+.

Do not confuse that cloud carve-out with Secure Private Access Hybrid. Citrix says Secure Private Access Hybrid deployments that use NetScaler instances are affected; you still upgrade those appliances to the builds above.

Sibling preconditions differ. CVE-2026-88772 needs DTLS enabled (on by default for VPN vServers unless you set -dtls OFF). CVE-2026-88775 needs Gateway or AAA. CVE-2026-88776 needs an Oracle LB vServer. CVE-2026-88771 does not: every default ADC/Gateway is in.

What broke

CTX697096 clusters eight CVEs on the same upgrade train. Treat them as one patch event.

• CVE-2026-88771 (CVSS 9.5): unauthenticated RCE via improper input validation. All NetScaler ADC and Gateway deployments. Default configuration. No additional feature required.
• CVE-2026-88772 (CVSS 9.5): memory overflow to RCE or DoS when DTLS is enabled. DTLS is enabled by default on VPN vServers.
• CVE-2026-88773 (CVSS 9.3): HTTP request smuggling when HTTP is configured.
• CVE-2026-88774 (CVSS 7.0): feature-policy bypass via HTTP URL-based policy expressions.
• CVE-2026-88775 (CVSS 8.8): memory overflow / DoS on Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers.
• CVE-2026-88776 (CVSS 8.8): memory overflow / DoS on Oracle-type LB virtual servers.
• CVE-2026-88777 (CVSS 8.8): memory overflow / DoS on LB/CS or CGNAT-LSN/NAT64 with certain non-HTTP L7 features (FTP, RTSP, DNS64, NAT64, and related patterns in the bulletin).
• CVE-2026-88778 (CVSS 8.8): TCP Initial Sequence Number prediction when TCP is configured and Enhanced ISN Generation is disabled.

Affected supported trains before the fixed builds: NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, ADC FIPS before 14.1-73.37 FIPS, and ADC FIPS/NDcPP before 13.1.37.279. Credit in the bulletin: Michael Tucker, Chew Keong Tan, and Alex Bernier (JPMorgan Chase XOR Team), and Maxim Suhanov.

What this is not

This is not a Gateway-only or AAA-only story. CVE-2026-88771 needs no special feature and hits every customer-managed NetScaler ADC and Gateway on the affected builds, including default config. It is also not limited to appliances you personally racked: Secure Private Access Hybrid NetScaler instances are in scope. Citrix-managed cloud and Adaptive Auth are the carve-out, not Hybrid SPA. We are not claiming CISA KEV listing today; the vendor statement is that exploits of CVE-2026-88771 and CVE-2026-88772 have already been observed on unmitigated deployments.

How to check

Confirm the build the appliance is actually running:

show ns version

Anything on 14.1 below 14.1-73.37, on 13.1 below 13.1-64.23, on 14.1-FIPS below 14.1-73.37 FIPS, or on 13.1-FIPS/NDcPP below 13.1.37.279 is still in the RCE window for CVE-2026-88771.

For CVE-2026-88772 (DTLS), inspect VPN and DTLS virtual servers. Patterns from CTX697096:

# DTLS on by default (vulnerable precondition for 88772)
add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE

# DTLS explicitly off (88772 precondition not met)
add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF -Listenpolicy NONE

# explicit DTLS vServers (precondition met)
add vpn vserver vs1 DTLS 10.11.1.1 443
add lb vserver vd_dtls DTLS 10.146.111.74 443 -persistenceType NONE -cltTimeout 120

For CVE-2026-88778, confirm Enhanced ISN Generation:

show ns tcpparam | grep "Enhanced ISN Generation"

If that returns Enhanced ISN Generation: DISABLED and you have TCP-family virtual servers, apply the Enhanced ISN change from the NetScaler TCP configuration docs in addition to the build upgrade. The bulletin points at Enhanced ISN Generation.

How to fix

Upgrade customer-managed NetScaler ADC and NetScaler Gateway to one of these builds (or later on the same train):

• NetScaler ADC / Gateway 14.1-73.37+
• NetScaler ADC / Gateway 13.1-64.23+ (13.1 train)
• NetScaler ADC FIPS 14.1-73.37 FIPS+
• NetScaler ADC FIPS / NDcPP 13.1.37.279+

Pull the builds from Citrix support, stage in a maintenance window that matches your HA / GSLB cutover, then re-check with show ns version. For CVE-2026-88778, also enable Enhanced ISN Generation per the TCP configuration doc above. There is no feature-flag substitute for the CVE-2026-88771 fix: every default deployment is in scope until the build is current.

If you run Secure Private Access Hybrid on NetScaler instances, upgrade those instances to the same builds. Do not assume the Citrix-managed cloud carve-out covers them.

References

• Citrix CTX697096: NetScaler ADC and NetScaler Gateway security bulletin
• NetScaler TCP configurations: Enhanced ISN Generation
• HOL Guard evidence pack: CVE-2026-88771