Inventory gaps that CVE-2026-88773 will expose in most NetScaler estates

The unglamorous prerequisite

Remediating CVE-2026-88773 depends on a list. The flaw, rated 9.3 in Citrix bulletin CTX697096, only matters on NetScaler ADC and Gateway instances with HTTP functionality enabled. An organisation that cannot enumerate those instances cannot claim to have closed the issue.

Why NetScaler inventories drift

Appliances get added for a proof of concept and never retired. Training and lab instances keep production certificates. Colleagues outside the core team spin up a virtual appliance to publish an internal service. Each of those is a plausible reason for an instance to exist without appearing in the patch tracker.

The external check

ZoomEye reports 239,194 assets matching app="Citrix NetScaler". That figure is a global product fingerprint count and says nothing about a specific organisation, but the technique generalises: an external search for the product fingerprint, compared against the internal record, reliably surfaces hosts that the internal processes missed.

The internal questions

For each discovered instance, three facts determine the response. Which version is installed, relative to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 for FIPS and NDcPP builds? Is HTTP enabled? Is the interface reachable by parties who should not have it?

FIPS and NDcPP deserve their own column

The bulletin lists separate fixed versions for FIPS and NDcPP builds. These tend to be governed by stricter change processes, which means they are often the last to move. Budgeting extra time for them avoids a late surprise.

What to keep

NCSC-NL recommends retaining logs and a memory dump before upgrading, because CVE-2026-88771 and CVE-2026-88772 in the same bulletin have been actively exploited. For an inventory-driven project, this is the step most likely to be skipped under time pressure and the one that cannot be reconstructed afterwards.

References

• Citrix security bulletin CTX697096
• NCSC-NL advisory NCSC-2026-0394
• CERT-FR advisory CERTFR-2026-AVI-1235
• CVE.org record for CVE-2026-88773