CVE-2026-88772 in citrix netscaler application delivery controller
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
Affected software: citrix netscaler application delivery controller, citrix netscaler gateway
Scores
- CVSS: 9.5 (critical)
- EPSS: 76.57% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-09-27
- Published: 2026-09-27
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Citrix NetScaler ADC and Gateway to a fixed build (CVE-2026-88772, CVE-2026-88771)
Patch or upgrade. Upgrade NetScaler ADC and NetScaler Gateway to a build Citrix lists as fixed in bulletin CTX697096. This closes the memory buffer flaw (CVE-2026-88772) and the input validation flaw (CVE-2026-88771) that attackers use for remote code execution or denial of service. Both are in KEV, so check upgraded appliances for signs of compromise too.
Applies to: Citrix NetScaler ADC and NetScaler Gateway: 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1 FIPS before 14.1-73.37 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.279. Customer-managed appliances only.
- List every NetScaler ADC and Gateway appliance, including HA pairs and VPX instances. Check each build with 'show ns version' on the CLI or under System, System Information in the GUI.
- Find which builds are affected: ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1 FIPS before 14.1-73.37 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.279.
- Download the fixed build from the Citrix downloads portal: 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, or 13.1-37.279 FIPS/NDcPP or later.
- Back up the configuration with 'save ns config' and copy /nsconfig/ns.conf off the appliance.
- On an HA pair, upgrade the secondary node first, fail over with 'force ha failover', then upgrade the former primary.
- Install the build: in the GUI go to System, Upgrade Wizard, or use the installns script from the shell. Reboot when it asks you to.
- Run 'show ns version' again on every node to confirm the fixed build.
- End of life versions such as 12.1 and 13.0 get no fix. Move them to a supported fixed release.
- The bug is exploited in the wild, so do a compromise check as Citrix describes in CTX694799. Look for unknown files in the web directories and for unexpected processes, cron jobs and accounts. Run the IOC checks Citrix publishes for this bulletin. Do this before you rely on the patch alone.
- If you find signs of compromise, treat the appliance as breached. Rebuild it from a clean image, rotate every credential and certificate stored on it, and kill the active sessions.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.