CISA KEV: NetScaler CVE-2026-88771 and CVE-2026-88772 Require New Patches After August Updates

If you run customer-managed NetScaler ADC or NetScaler Gateway, especially as the internet-facing front door to Citrix Virtual Apps and Desktops, Windows RDP proxying or SSL VPN, treat this as urgent.

The two CVEs CISA added​

CISA's alert names these two flaws:

• CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix published its bulletin, CTX697096, the same day. It covers eight CVEs, but Citrix reports exploitation for only these two. The bulletin says: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," and Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.

CVE-2026-88771 is the worse of the two. Its exposure is unusually broad: every NetScaler ADC and NetScaler Gateway deployment is affected, including default configurations, with no optional feature required. Checking your configuration won't get you out of this one. If the build is unpatched, the appliance is exposed.

CVE-2026-88772 needs DTLS, the UDP-based version of the TLS encryption protocol, and NetScaler turns DTLS on by default for VPN virtual servers. Most Gateway deployments exist to run VPN virtual servers, so assuming DTLS is off because you never turned it on is a risky bet.

Section summary: Both vulnerabilities are rated critical and are being exploited. One affects every deployment, and the other affects most Gateway setups because of a default setting.

How this unfolded​

Citrix's disclosure followed a weekend of vague warnings. According to BleepingComputer, these were the same zero-days that cybersecurity researchers, IT providers, and national cybersecurity agencies began privately warning organizations about over the weekend. News4Hackers reported that early indications of the incident emerged when IT administrators reported unsolicited communications from security teams advising immediate shutdowns of NetScaler appliances.

Security firm watchTowr went public first. The Hacker News reports that watchTowr's first post on X on September 26 said it was reacting to rumors of several unpatched NetScaler RCE vulnerabilities in the wild. Cyber Kendra says watchTowr later added that the exploitation was discovered during forensic investigations. Until Citrix published, Cyber Security News notes, Citrix had not released CVE identifiers, affected builds, indicators of compromise, or patches, forcing some organizations to consider isolating exposed appliances while awaiting authoritative guidance.

In short, the attacks started before the patches existed. That affects your response, as covered below.

Affected builds and fixed releases​

Citrix lists these supported versions as vulnerable:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
• NetScaler ADC FIPS before 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP before 13.1-37.279

To fix it, install the matching release or anything later in the same branch.

Watch out for the August builds. The Hacker News reports that appliances on 14.1-73.32 and 13.1-63.21, the builds that fixed the exploited authentication bypass CVE-2026-19490 in August, fall inside the affected range and need the new update. If your team closed out that emergency last month, those appliances need patching again.

The scope has limits too. Citrix says the bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway appliances. Cloud Software Group is upgrading Citrix-managed cloud services and Citrix-managed Adaptive Authentication. There's one catch: Secure Private Access Hybrid deployments using NetScaler instances are also affected and must be upgraded to the recommended builds.

Checking the DTLS precondition for CVE-2026-88772​

Citrix's bulletin shows configuration patterns you can look for in your running config. A Gateway is vulnerable unless DTLS has been explicitly turned off. Any other virtual server is vulnerable if it's configured as type DTLS.

• add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE: DTLS hasn't been disabled, so it's on by default. Precondition met.
• add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF -Listenpolicy NONE: DTLS is explicitly disabled. Precondition not met.
• add vpn vserver vs1 DTLS 10.11.1.1 443: DTLS is enabled.
• add lb vserver vd_dtls DTLS 10.146.111.74 443 -persistenceType NONE -cltTimeout 120: DTLS is enabled.

This check matters less than it looks. Turning DTLS off doesn't protect you from CVE-2026-88771, which needs no special configuration at all. Citrix offers these patterns to help you understand exposure. They are not a replacement for upgrading.

A practical response plan​

This plan is based on Citrix's guidance and on how edge-appliance incidents usually go:

1. Inventory every customer-managed ADC and Gateway, including DR pairs, lab boxes that ended up internet-facing, and NetScaler instances behind Secure Private Access Hybrid.
2. Check the build number on each one against the fixed releases above. Anything on 14.1-73.32 or 13.1-63.21 still needs the update.
3. Upgrade to 14.1-73.37, 13.1-64.23 or the matching FIPS/NDcPP release, or later.
4. Assume you may already have been hit. The flaws were exploited before patches existed, so patching closes the hole but won't remove an attacker who's already inside. Cyber Kendra points out that in 2025, NCSC-NL warned that intruders could keep access after patches were applied, and it published compromise-check scripts for NetScaler images and core dumps. Citrix's bulletin links to a companion NetScaler blog with more context, and you should review it as part of your investigation.
5. Check what the appliance can reach. Cyber Security News warns that because these appliances operate at the network edge and manage trusted traffic, a successful exploitation can create a strong foothold for lateral movement and credential theft. Consider rotating credentials and session secrets the appliance handles, and look for unusual authentication activity against Active Directory and Entra-connected resources behind the Gateway.
6. Deal with the other six CVEs in the same maintenance window. The fixed builds cover them too. For CVE-2026-88778, Citrix also recommends enabling Enhanced ISN Generation in the TCP settings.

What KEV listing means for you​

CISA's alert says Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," sets vulnerability-management rules for Federal Civilian Executive Branch (FCEB) agencies. Under the directive, agencies must prioritize fast remediation of KEV-listed CVEs on publicly exposed assets where exploitation gives total control of the asset, and can defer lower-risk issues. The directive also sets expectations for when agencies have to check whether attackers compromised a system before it was patched.

That describes this case almost exactly. NetScaler Gateways are public-facing by design, and unauthenticated command execution gives an attacker control of the box. The compromise-check requirement is a reminder that patching is only part of the job.

BOD 26-04 is binding only on FCEB agencies. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV entries. The alert doesn't give remediation due dates for these two CVEs, so don't assume one. Some third-party vulnerability databases were still showing the older, pre-listing status for CVE-2026-88771 on the day of the addition. If your scanner or dashboard hasn't caught up, go by CISA's catalog and Citrix's bulletin.

The bigger picture​

NetScaler has now had critical, exploited vulnerabilities several months running: the August authentication bypass, and now two unauthenticated RCEs that were exploited before a fix existed. Edge appliances are attractive targets because, as BleepingComputer notes, organizations commonly deploy them as Internet-facing edge devices that provide remote access and application delivery services for internal corporate networks. One unpatched Gateway can put an entire Windows estate behind it at risk.

In fairness to Citrix, it confirmed exploitation, published fixed builds and gave specific precondition checks within about a day of the public rumors. Customers still spent a weekend deciding whether to take their remote-access gateways offline based on second-hand phone calls, and many are now patching boxes they fixed only weeks ago. For customer-managed NetScaler, that's the situation: upgrade to 14.1-73.37, 13.1-64.23 or the matching FIPS/NDcPP build now, and check each appliance for signs of compromise.