NetScaler RCE Flaws CVE-2026-88771/88772: Fixed Builds, DTLS Risk and Sept. 30 Deadline

Two flaws, different exposure conditions​

Both vulnerabilities can lead to remote code execution, but administrators should not treat their configuration requirements as interchangeable:

• CVE-2026-88771 is an improper-input-validation flaw that can allow an unauthenticated remote attacker to execute commands. Citrix says all affected NetScaler ADC and Gateway deployments meet its configuration precondition, including default installations. Disabling a particular optional feature does not take an older build out of scope.
• CVE-2026-88772 is a memory-overflow flaw that can lead to remote code execution or denial of service when DTLS is enabled. That condition deserves a careful check: Citrix says DTLS is enabled by default on VPN virtual servers, so an administrator need not have switched it on deliberately.

Citrix rates each flaw 9.5 under CVSS v4 and says exploitation of both has been observed on unmitigated deployments. The distinction matters operationally: confirming DTLS is off may rule out the second flaw’s stated precondition, but it does nothing to resolve the first on an affected build.

Citrix’s September 27 bulletin covers eight NetScaler vulnerabilities in total. The other six include issues involving HTTP request smuggling, policy bypass, denial of service and TCP sequence-number prediction, with their own configuration conditions. Citrix’s confirmation of observed exploitation specifically names 88771 and 88772; it should not be read as confirmation that all eight are being exploited.

Which builds need attention?​

For supported, customer-managed appliances, Citrix identifies these fixed builds or later releases in the corresponding branches:

The bulletin also includes Secure Private Access Hybrid deployments that use NetScaler instances: customers must upgrade those instances. It applies to customer-managed ADC and Gateway appliances; Citrix says it handles updates to Citrix-managed cloud services and Citrix-managed Adaptive Authentication. In other words, inventory the NetScaler appliance and its build, not merely the application or service name on the change ticket.

Patch promptly—but preserve evidence if compromise is suspected​

A sensible response has two tracks. Close the vulnerability by moving affected appliances to the appropriate fixed build, and assess whether attackers reached them before the upgrade. As BleepingComputer reports, CISA advises checking for indications of compromise before patching when possible and preserving forensic evidence first if compromise is suspected, because an update may reduce forensic visibility. That is not a reason to leave an exposed appliance unpatched indefinitely; it is a reason to coordinate the upgrade with incident responders. Citrix cautions that its generic indicators available through NetScaler Console may miss genuine compromises.

For teams using NetScaler Console, Citrix documents a practical way to identify instances affected by CVE-2026-88771:

1. Open the security advisory dashboard, choose CVE Detection, and search for CVE-2026-88771 on the Impacted Instances tab.
2. If results have not appeared, allow for the advisory scan’s stated delay of up to a couple of hours, or select Scan-Now to request an on-demand scan.
3. Select impacted instances and choose Proceed to upgrade workflow. Confirm afterward that each appliance is running the fixed build for its branch.

That Console workflow helps find and upgrade managed instances; it is not a clean bill of forensic health. For CVE-2026-88772, Citrix additionally tells administrators to inspect virtual-server configurations for DTLS. On a VPN virtual server, the absence of an explicit -dtls OFF means DTLS is enabled by default; an explicit -dtls OFF means that particular precondition is not met.

The takeaway: Wednesday’s deadline is a federal requirement, while the attack risk is not confined to federal networks. Check the appliance builds, account for DTLS defaults, upgrade affected systems, and investigate suspected prior access rather than assuming a successful patch proves the appliance was never compromised.