2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild [1].

CERT-EU recommends updating affected software and running a compromise assessment on those exposed on the internet.

The vulnerability CVE-2026-88771, with a CVSS score of 9.5, is an unauthenticated RCE flow due to improper input validation. As there is no precondition for the exploitation, it affects all Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. It is exploited in the wild [1].

The vulnerability CVE-2026-88772, with a CVSS score of 9.5, a memory overflow vulnerability leading to RCE or Denial of Service (DoS). It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where DTLS is enabled (default on VPN vServer). It is exploited in the wild [1].

The vulnerability CVE-2026-88773, with a CVSS score of 9.3, is an HTTP Request Smuggling vulnerability. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1].

The vulnerability CVE-2026-88774, with a CVSS score of 7.0, is a feature policy bypass via HTTP URL-based expression flow. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1].