Recently, Citrix has released security updates to address eight vulnerabilities (CVE-2026-88771 to CVE-2026-88778) in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, are critical remote code execution flaws that Citrix has confirmed are being actively exploited.
2.0 Impact
Successful exploitation may allow an
unauthenticated remote attacker to execute arbitrary commands on the appliance
(CVE-2026-88771), or to cause remote code execution or denial of service
through a memory buffer flaw (CVE-2026-88772). A compromised appliance may
expose VPN credentials and internal applications, and may serve as a foothold
into the network.
3.0 Affected Products
- NetScaler ADC and NetScaler Gateway 14.1, versions before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1, versions before 13.1-64.23
- NetScaler ADC 14.1-FIPS, versions before 14.1-73.37 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP, versions before 13.1-37.279
4.0 Recommendations
CyberSecurity
Malaysia encourages users and administrators to review the Citrix Security Bulletin and
apply the necessary updates.
Kindly
refer to the following URL: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Generally, we advise users to be updated with
the latest security announcements by the vendor and follow best practice
security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
- https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
- https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
- https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway