DEV Community

Cover image for BREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)
HOL (Hashgraph Online) profile image Michael Kantor
Michael Kantor for HOL (Hashgraph Online)

Posted on Originally published at hol.org

BREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)

#cve #netscaler #citrix #rce

Originally published at HOL

BREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)

Citrix published security bulletin CTX697096 on 2026-09-27 for eight NetScaler ADC / NetScaler Gateway flaws. The lead issue is CVE-2026-88771: unauthenticated remote code execution from improper input validation on every customer-managed NetScaler ADC and Gateway deployment, including default configuration. No extra feature has to be turned on. Citrix rates it CVSS v4.0 9.5 and states that exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments have been observed. Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS/NDcPP. This is the operator write-up from CTX697096 and the CVE AWG records. The HOL Guard evidence pack for the lead CVE is at /guard/security/cves/CVE-2026-88771.

Who is not in scope

Skip the pager only if one of these is true:

  • Cloud Software Group already runs the appliance for you. CTX697096 applies to customer-managed NetScaler ADC and NetScaler Gateway only. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by CSG.
  • Every customer-managed ADC/Gateway instance you own is already on 14.1-73.37+, 13.1-64.23+, 14.1-73.37 FIPS+, or 13.1.37.279 FIPS/NDcPP+.

Do not confuse that cloud carve-out with Secure Private Access Hybrid. Citrix says Secure Private Access Hybrid deployments that use NetScaler instances are affected; you still upgrade those appliances to the builds above.

Sibling preconditions differ. CVE-2026-88772 needs DTLS enabled (on by default for VPN vServers unless you set -dtls OFF). CVE-2026-88775 needs Gateway or AAA. CVE-2026-88776 needs an Oracle LB vServer. CVE-2026-88771 does not: every default ADC/Gateway is in.

What broke

CTX697096 clusters eight CVEs on the same upgrade train. Treat them as one patch event.

  • CVE-2026-88771 (CVSS 9.5): unauthenticated RCE via improper input validation. All NetScaler ADC and Gateway deployments. Default configuration. No additional feature required.
  • CVE-2026-88772 (CVSS 9.5): memory overflow to RCE or DoS when DTLS is enabled. DTLS is enabled by default on VPN vServers.
  • CVE-2026-88773 (CVSS 9.3): HTTP request smuggling when HTTP is configured.
  • CVE-2026-88774 (CVSS 7.0): feature-policy bypass via HTTP URL-based policy expressions.
  • CVE-2026-88775 (CVSS 8.8): memory overflow / DoS on Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers.
  • CVE-2026-88776 (CVSS 8.8): memory overflow / DoS on Oracle-type LB virtual servers.
  • CVE-2026-88777 (CVSS 8.8): memory overflow / DoS on LB/CS or CGNAT-LSN/NAT64 with certain non-HTTP L7 features (FTP, RTSP, DNS64, NAT64, and related patterns in the bulletin).
  • CVE-2026-88778 (CVSS 8.8): TCP Initial Sequence Number prediction when TCP is configured and Enhanced ISN Generation is disabled.

Affected supported trains before the fixed builds: NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, ADC FIPS before 14.1-73.37 FIPS, and ADC FIPS/NDcPP before 13.1.37.279. Credit in the bulletin: Michael Tucker, Chew Keong Tan, and Alex Bernier (JPMorgan Chase XOR Team), and Maxim Suhanov.

What this is not

This is not a Gateway-only or AAA-only story. CVE-2026-88771 needs no special feature and hits every customer-managed NetScaler ADC and Gateway on the affected builds, including default config. It is also not limited to appliances you personally racked: Secure Private Access Hybrid NetScaler instances are in scope. Citrix-managed cloud and Adaptive Auth are the carve-out, not Hybrid SPA. CISA KEV caught up on 2026-09-27 for CVE-2026-88771 and CVE-2026-88772 (due 2026-09-30, forensic triage Yes). Citrix already stated exploits of both were observed on unmitigated deployments; treat the KEV rows plus CTX697096 as the operational clock.

How to check

Confirm the build the appliance is actually running:

show ns version
Enter fullscreen mode Exit fullscreen mode

Anything on 14.1 below 14.1-73.37, on 13.1 below 13.1-64.23, on 14.1-FIPS below 14.1-73.37 FIPS, or on 13.1-FIPS/NDcPP below 13.1.37.279 is still in the RCE window for CVE-2026-88771.

For CVE-2026-88772 (DTLS), inspect VPN and DTLS virtual servers. Patterns from CTX697096:

# DTLS on by default (vulnerable precondition for 88772)
add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE

DTLS explicitly off (88772 precondition not met)
add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF -Listenpolicy NONE
explicit DTLS vServers (precondition met)
Enter fullscreen mode Exit fullscreen mode

For CVE-2026-88778, confirm Enhanced ISN Generation:

show ns tcpparam | grep "Enhanced ISN Generation"
Enter fullscreen mode Exit fullscreen mode

If that returns Enhanced ISN Generation: DISABLED and you have TCP-family virtual servers, apply the Enhanced ISN change from the NetScaler TCP configuration docs in addition to the build upgrade. The bulletin points at Enhanced ISN Generation.

How to fix

Upgrade customer-managed NetScaler ADC and NetScaler Gateway to one of these builds (or later on the same train):

  • NetScaler ADC / Gateway 14.1-73.37+
  • NetScaler ADC / Gateway 13.1-64.23+ (13.1 train)
  • NetScaler ADC FIPS 14.1-73.37 FIPS+
  • NetScaler ADC FIPS / NDcPP 13.1.37.279+

Pull the builds from Citrix support, stage in a maintenance window that matches your HA / GSLB cutover, then re-check with show ns version. For CVE-2026-88778, also enable Enhanced ISN Generation per the TCP configuration doc above. There is no feature-flag substitute for the CVE-2026-88771 fix: every default deployment is in scope until the build is current.

If you run Secure Private Access Hybrid on NetScaler instances, upgrade those instances to the same builds. Do not assume the Citrix-managed cloud carve-out covers them.

CISA KEV (added 2026-09-27)

CISA added CVE-2026-88771 and CVE-2026-88772 (both already covered in this NetScaler cluster write-up) to the Known Exploited Vulnerabilities catalog on 2026-09-27 (catalog version 2026.09.27). Federal and BOD 26-04 covered operators have until 2026-09-30. Both KEV rows require forensic triage (Yes). Ransomware use is listed as Unknown. Citrix already stated exploits of both CVEs were observed on unmitigated deployments; the KEV listing is the federal must-patch clock on the same upgrade train, not a new technical finding. Siblings CVE-2026-88773 through CVE-2026-88778 are not in the 2026-09-27 KEV batch.

References

Top comments (0)