1.0 Introduction
Citrix
NetScaler has released security updates to address multiple vulnerabilities
affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. The
vulnerabilities and their respective Common Vulnerability Scoring System (CVSS)
scores are:
- CVE-2026-88771
and CVE-2026-88772
- CVE-2026-88773
- CVE-2026-88774
- CVE-2026-88775
to CVE-2026-88778
2.0 Impact
Successful exploitation could allow an unauthenticated attacker to execute
arbitrary commands on affected Citrix NetScaler ADC and Citrix NetScaler
Gateway appliances.
These vulnerabilities, which include improper input
validation, memory overflows and inconsistent interpretation of HTTP requests,
could also lead to remote code execution, denial of service, unpredictable or
erroneous behaviour, HTTP request/response smuggling and a feature policy
bypass.
3.0 Affected Versions
- Citrix
NetScaler ADC versions before 14.1-73.37
- Citrix
NetScaler ADC versions before 13.1-64.23
- Citrix
NetScaler ADC versions before 13.1.37.279 FIPS and NDcPP
- Citrix
NetScaler ADC versions before 13.1-37.279 and NDcPP
- Citrix
NetScaler Gateway versions before 14.1-73.37
- Citrix
NetScaler Gateway versions before 13.1-64.23
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review
the Citrix
Security Bulletin and apply the necessary updates.
Kindly refer to the following URL:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://www.citrix.com/
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
- https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://nvd.nist.gov/vuln/detail/CVE-2026-88771
- https://nvd.nist.gov/vuln/detail/CVE-2026-88772
- https://nvd.nist.gov/vuln/detail/CVE-2026-88773
- https://nvd.nist.gov/vuln/detail/CVE-2026-88774
- https://nvd.nist.gov/vuln/detail/CVE-2026-88775
- https://nvd.nist.gov/vuln/detail/CVE-2026-88776
- https://nvd.nist.gov/vuln/detail/CVE-2026-88777
- https://nvd.nist.gov/vuln/detail/CVE-2026-88778