CVE-2026-88772 in NetScaler ADC
Summary
by MITRE • 09/27/2026
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The identified vulnerability resides within the core architecture of Citrix NetScaler ADC and NetScaler Gateway appliances, representing a critical security flaw that compromises the integrity and availability of enterprise network infrastructure. This issue specifically impacts versions prior to 14.1-73.37 for both ADC and Gateway platforms, as well as earlier builds such as 13.1-64.23 and specific FIPS or NDcPP compliant variants like 14.1-73.37 FIPS and 13.1.37.279 FIPS. The severity of this flaw is underscored by its potential to facilitate Remote Code Execution, allowing an attacker to gain unauthorized control over the underlying operating system or application layer, as well as Denial of Service conditions that can render critical services inaccessible to legitimate users.
From a technical perspective, vulnerabilities in NetScaler ADC and Gateway often stem from improper input validation or logic errors within the management interface or API endpoints exposed to external networks. When an attacker crafts specific malicious requests targeting these unpatched versions, they may exploit memory corruption issues, buffer overflows, or deserialization flaws that bypass standard authentication mechanisms. The ability to achieve Remote Code Execution indicates a complete breakdown of security boundaries, where the application fails to properly isolate user input from system commands. This allows for arbitrary code execution with the privileges of the service account running the NetScaler process, which typically possesses high-level administrative rights necessary for device configuration and management.
The operational impact of this vulnerability is profound for organizations relying on Citrix infrastructure for remote access and application delivery. Successful exploitation could lead to a total compromise of the network perimeter, as attackers can pivot from the compromised appliance into internal networks, exfiltrate sensitive data, or deploy additional malware such as ransomware. Furthermore, the Denial of Service aspect poses a significant risk to business continuity, potentially causing widespread outages for employees and customers depending on these services for daily operations. The presence of this flaw in FIPS and NDcPP variants is particularly concerning for regulated industries that require strict compliance with federal security standards, as it indicates a fundamental weakness even in hardened configurations designed to meet rigorous cryptographic and operational requirements.
Industry classification frameworks categorize such flaws under CWE-78 Improper Neutralization of Special Elements used in an OS Command or CWE-200 Exposure of Sensitive Information depending on the specific vector utilized by the attacker. In terms of adversary tactics, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access via Exploitation of Remote Services and Privilege Escalation if local access is gained before remote execution. Attackers frequently leverage automated scanning tools to identify unpatched instances of NetScaler ADC across the internet, making rapid remediation essential for maintaining a strong security posture.
Mitigation strategies must prioritize immediate patching to the latest stable release versions that address these specific flaws. Organizations should verify their current build numbers against the provided thresholds and apply updates through official Citrix channels as soon as possible. In scenarios where immediate patching is not feasible due to operational constraints, network-level controls such as Web Application Firewalls can be configured to block known exploit patterns associated with this vulnerability. Additionally, restricting access to the management interface by IP address or implementing multi-factor authentication adds layers of defense that reduce the attack surface available to potential adversaries. Continuous monitoring for anomalous traffic patterns and regular security assessments are also recommended to detect any attempted exploitation activities in real-time.