Skip to main content
VulnerabilityPublished

Community Threat Notice: Citrix NetScaler ADC and NetScaler Gateway Vulnerabilities

Source Reddit Malware

0

Mentioned vulnerabilities

Severity
Medium

Rated by Threat Radar

Data as of 29 Sep 2026, 22:21 UTC

What to do

AI-suggested

Citrix has released official security updates that address all disclosed vulnerabilities. Immediate application of these updates to all affected NetScaler ADC and NetScaler Gateway appliances is strongly recommended. Additionally, restrict access to NetScaler management interfaces to trusted internal networks and administrative hosts only. Review logs and systems for signs of unauthorized access or persistence, even on patched systems. Monitor authentication and connection activity for anomalies. Rotate credentials, certificates, and secrets if compromise is suspected. Follow the Citrix advisory at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 for detailed guidance.

Discussion

Citrix has disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway appliances, including two critical vulnerabilities actively exploited in the wild. These devices are critical network perimeter components handling VPN, remote access, load balancing, and authentication. The two actively exploited vulnerabilities allow unauthenticated remote code execution and denial-of-service attacks. Citrix has released updates to address these issues and recommends immediate patching and restricting management interfaces to trusted networks.

r/Malware (opens in a new tab)u/blackpointcyber0 points0 comments

Citrix has disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway; including two actively exploited.

NetScaler ADC and NetScaler Gateway sit at the network perimeter, handling VPN, remote access, load balancing, and authentication for enterprise environments, making compromise a high-impact event with broad downstream consequences.

CVE-2026-88771 | 9.5 Critical | Improper Input Validation

  • An unauthenticated attacker can exploit this vulnerability to run arbitrary commands on the appliance.
  • This vulnerability affects all NetScaler ADC and NetScaler Gateway deployments on an affected version, including those in the default configuration.

CVE-2026-88772 | 9.5 Critical | Memory Overflow

  • An attacker can exploit this vulnerability to achieve remote code execution or cause a denial-of-service condition.
  • This vulnerability affects appliances with DTLS enabled, which is on by default for VPN virtual servers on NetScaler Gateway.

Citrix has confirmed that both vulnerabilities have been exploited in the wild against unmitigated NetScaler deployments, and both have been added to the CISA Known Exploited Vulnerabilities catalog.

Other vulnerabilities included in the advisory, but not reported as actively exploited

  • CVE-2026-88773 | 9.3 Critical | HTTP Request Smuggling
  • CVE-2026-88774 | 7.0 High | Policy Bypass
  • CVE-2026-88775 | 8.8 High | Memory Overflow
  • CVE-2026-88776 | 8.8 High | Memory Overflow
  • CVE-2026-88777 | 8.8 High | Memory Overflow
  • CVE-2026-88778 | 8.8 High | TCP Initial Sequence Number (ISN) Prediction

Recommendations

  • Immediate Action: Apply Citrix-released updates to all affected NetScaler ADC and NetScaler Gateway appliances immediately.
  • Restrict NetScaler management interfaces to trusted internal networks and administrative hosts.
  • Review vulnerable appliances for signs of unauthorized access or persistence, including systems already patched.
  • Monitor authentication activity and connections from NetScaler appliances for suspicious or unexpected behavior.
  • Rotate credentials, certificates, and secrets if compromise or unauthorized access is suspected.

References

References

Community reviews

Loading reviews…