CVE-2026-88778: CWE-342 Predictable exact value from previous values in Citrix NetScaler ADC
CVE-2026-88778 is a high-severity vulnerability in Citrix NetScaler ADC and Gateway products involving predictable exact values derived from previous values. This weakness could potentially allow attackers to anticipate sensitive values, impacting confidentiality and integrity. The vulnerability affects multiple versions of Citrix NetScaler ADC and Gateway prior to specific fixed releases.
AI Analysis
Technical Summary
This vulnerability, identified as CWE-342 (Predictable exact value from previous values), affects Citrix NetScaler ADC and Gateway products. Versions before 14.1-73.37 and 13.1-64.23 for ADC and Gateway are vulnerable, including FIPS and NDcPP variants. The issue allows an attacker to predict exact values based on previous values, which may compromise security properties. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability could allow remote attackers to predict exact values derived from previous values, potentially leading to unauthorized disclosure or manipulation of sensitive data. The high CVSS score reflects significant impact on confidentiality, integrity, and availability, though no known exploits are currently reported in the wild.
Mitigation Recommendations
Citrix has released fixed versions that address this vulnerability. Users should upgrade to versions 14.1-73.37 or later and 13.1-64.23 or later for both ADC and Gateway products, including FIPS and NDcPP variants. No cloud service remediation applies as this is not a cloud service. Patch status is confirmed by the version boundaries stated.
CVE-2026-88778: CWE-342 Predictable exact value from previous values in Citrix NetScaler ADC
Description
CVE-2026-88778 is a high-severity vulnerability in Citrix NetScaler ADC and Gateway products involving predictable exact values derived from previous values. This weakness could potentially allow attackers to anticipate sensitive values, impacting confidentiality and integrity. The vulnerability affects multiple versions of Citrix NetScaler ADC and Gateway prior to specific fixed releases.
CVSS v4.0
Score 8.8high
Affected software
Citrix NetScaler
ADC
Citrix NetScaler
Gateway
pkg:deb/citrix/netscaler-adcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability, identified as CWE-342 (Predictable exact value from previous values), affects Citrix NetScaler ADC and Gateway products. Versions before 14.1-73.37 and 13.1-64.23 for ADC and Gateway are vulnerable, including FIPS and NDcPP variants. The issue allows an attacker to predict exact values based on previous values, which may compromise security properties. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability could allow remote attackers to predict exact values derived from previous values, potentially leading to unauthorized disclosure or manipulation of sensitive data. The high CVSS score reflects significant impact on confidentiality, integrity, and availability, though no known exploits are currently reported in the wild.
Mitigation Recommendations
Citrix has released fixed versions that address this vulnerability. Users should upgrade to versions 14.1-73.37 or later and 13.1-64.23 or later for both ADC and Gateway products, including FIPS and NDcPP variants. No cloud service remediation applies as this is not a cloud service. Patch status is confirmed by the version boundaries stated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NetScaler
- Date Reserved
- 2026-09-10T07:14:57.370Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab948d1f7a7c541063df7be
Added to database: 09/27/2026, 16:48:17 UTC
Last enriched: 09/27/2026, 17:02:54 UTC
Last updated: 09/27/2026, 17:50:31 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.