The Citrix NetScaler vulnerability disclosures of September and October 2026 affect NetScaler ADC and NetScaler Gateway deployments. CVE-2026-88771 and CVE-2026-88772 are critical vulnerabilities that Citrix confirms have been exploited in the wild. CVE-2026-88779 and CVE-2026-107406 require separate assessment. Administrators should verify their software builds, review the relevant configurations, and apply the latest applicable Citrix security updates.
A vulnerable NetScaler appliance can put application delivery, remote access, and connected enterprise services at risk. The immediate challenge is determining which vulnerability applies to a particular deployment, whether attackers may have exploited it, and which software update resolves the issue.
This guide examines the major Citrix NetScaler security vulnerabilities reported by October 14, 2026. It uses vendor advisories and government security guidance to distinguish confirmed exploitation from potential exposure and provides a practical framework for administrators investigating their deployments.
What Administrators Need to Know About the Citrix NetScaler Vulnerability in 2026
Citrix NetScaler ADC and NetScaler Gateway are affected by multiple security vulnerabilities disclosed in September and October 2026. The most urgent issues include unauthenticated remote code execution and memory-overflow flaws. However, not every vulnerability has the same configuration requirements, severity, or remediation build.
The September 27 advisory covers eight vulnerabilities, CVE-2026-88771 through CVE-2026-88778. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited when Citrix disclosed them. The October disclosures added CVE-2026-88779 and CVE-2026-107406 to the investigation.
Administrators should focus on four questions:
- Is the appliance running an affected software build?
- Does its configuration meet the vulnerability’s prerequisites?
- Has the vendor released a fix for every applicable CVE?
- Is there evidence of unauthorized activity that requires incident response?
These questions matter because upgrading addresses software vulnerabilities, but it does not automatically establish that an appliance has never been compromised.
Which CVEs Affect Citrix NetScaler ADC and Gateway?
The following table compares the principal vulnerabilities covered in this article. Severity scores and technical descriptions are based on published records and advisories available as of October 14, 2026.
| CVE | Vulnerability | Prerequisite or scope | Severity and status |
|---|---|---|---|
| CVE-2026-88771 | Improper input validation leading to remote code execution | All NetScaler ADC and Gateway deployments; no additional feature required | Critical, CVSS 9.5; confirmed exploitation |
| CVE-2026-88772 | Memory overflow leading to remote code execution or denial of service | DTLS enabled; enabled by default on VPN virtual servers | Critical, CVSS 9.5; confirmed exploitation |
| CVE-2026-88773 | HTTP request smuggling | HTTP configuration enabled | Critical, CVSS 9.3 |
| CVE-2026-88774 | Feature-policy bypass involving HTTP URL-based expressions | Relevant policy expressions configured | CVSS 7.0 |
| CVE-2026-88775 | Memory overflow causing unexpected behavior or denial of service | Gateway or AAA virtual-server configuration | CVSS 8.8 |
| CVE-2026-88776 | Memory overflow causing unexpected behavior or denial of service | Oracle-type load-balancing virtual server | CVSS 8.8 |
| CVE-2026-88777 | Memory overflow causing unexpected behavior or denial of service | Specific non-HTTP Layer 7 protocol features or NAT configurations | CVSS 8.8 |
| CVE-2026-88778 | TCP initial sequence number prediction | Relevant TCP configuration | CVSS 8.8 |
| CVE-2026-88779 | Memory overflow leading to denial of service | Affected version branches | High, CVSS 8.7; confirmed exploitation |
| CVE-2026-107406 | Memory overflow leading to remote code execution or denial of service | SAML Service Provider or Identity Provider configuration, subject to version-specific conditions | Critical, CVSS 9.5 |
Sources: Citrix September security bulletin, Citrix October security bulletin, and CVE-2026-88779 record.
CVE-2026-88771: Improper input validation
CVE-2026-88771 is a critical remote code execution vulnerability caused by improper input validation. Citrix assigns it a CVSS v4.0 score of 9.5 and states that all NetScaler ADC and NetScaler Gateway deployments are affected, including default configurations. No additional feature needs to be enabled for the vulnerability to apply.
The lack of an additional configuration prerequisite makes this issue especially important for inventory and patch prioritization. Administrators should not assume that an appliance is safe simply because it does not use DTLS or SAML.
CVE-2026-88772: Memory overflow involving DTLS
CVE-2026-88772 is a critical memory-overflow vulnerability that can lead to remote code execution or denial of service. Its prerequisite is DTLS being enabled on NetScaler ADC or Gateway. Citrix specifically notes that DTLS is enabled by default on VPN virtual servers.
Administrators should inspect the configuration rather than relying on assumptions about their VPN setup. Even if DTLS is disabled on a particular virtual server, other vulnerabilities in the September advisory may still apply.
CVE-2026-88773 through CVE-2026-88778
The remaining September vulnerabilities affect different features and configurations. They include HTTP request smuggling, policy bypass, memory-overflow issues, and TCP sequence-number prediction. Their prerequisites range from HTTP virtual servers and URL-based policy expressions to Oracle load balancing and specific network protocol features.
This group demonstrates why a single statement such as “our NetScaler configuration is not using DTLS” is not enough to establish that a deployment is unaffected. Each relevant CVE needs its own configuration and version check.
CVE-2026-88779: An additional October vulnerability
CVE-2026-88779 is a separate memory-overflow vulnerability associated with denial of service. Its CVSS v4.0 score is 8.7. The Canadian Centre for Cyber Security reported that Citrix confirmed exploitation in the wild and noted that CISA added this CVE to its Known Exploited Vulnerabilities catalog on October 4, 2026.
Administrators who installed the September updates should still check the October advisory. A fix for one CVE does not establish that a deployment is protected against a different vulnerability disclosed later.
What Happened on September 27, 2026?
On September 27, 2026, Citrix published its security bulletin covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. CISA subsequently highlighted the two critical zero-days, CVE-2026-88771 and CVE-2026-88772, and confirmed that threat actors were actively exploiting them globally.
The significance of the disclosure was not limited to the severity scores. Both vulnerabilities could independently enable remote code execution, potentially giving attackers control over an affected appliance.
CISA also warned that updates can require operational planning and may cause downtime. It advised organizations to review the vendor guidance and, where possible, check for indicators of compromise before patching. If compromise is suspected, preserving forensic evidence is important because updating may reduce the visibility of earlier malicious activity.
Vulnerability does not mean confirmed compromise
Three conditions must remain distinct:
- Potential exposure: The appliance’s software version and configuration meet the vulnerability conditions.
- Confirmed exploitation in the wild: Credible sources report that attackers are exploiting the vulnerability.
- Confirmed compromise: Investigation finds evidence that a specific appliance was accessed or altered without authorization.
An organization can have an exposed appliance without confirmed evidence of compromise. Conversely, installing a patch does not prove that an attacker did not gain access before the update.
This distinction should guide both incident response and communication with management.
Which NetScaler Versions Are Affected?
The September advisory identifies affected supported branches below the following fixed builds. The October advisories introduce additional requirements, so administrators should use the newest applicable vendor guidance rather than treating the September version table as the final answer.
| Product branch | September fixed build |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 and later |
| NetScaler ADC FIPS 14.1 | 14.1-73.37 FIPS and later |
| NetScaler ADC FIPS and NDcPP 13.1 | 13.1-37.279 and later |
These builds address the September vulnerability group covered by the original advisory. They should not be interpreted as the latest required builds for every vulnerability disclosed afterward.
October fixed builds for CVE-2026-107406
Citrix recommends the following versions or later releases for CVE-2026-107406:
| Product branch | Recommended fixed build |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.46 |
| NetScaler ADC and Gateway 13.1 | 13.1-64.29 |
| NetScaler ADC FIPS 14.1 | 14.1-73.46 FIPS |
| NetScaler ADC FIPS and NDcPP 13.1 | 13.1-37.283 |
The advisory also specifies version-dependent SAML conditions. Some intermediate builds are affected only when configured as a SAML Identity Provider, while other affected versions require the appliance to be configured as either a SAML Service Provider or Identity Provider.
Use the official CVE-2026-107406 advisory to verify the precise conditions for the product edition in use.
What about cloud-managed services?
The cited Citrix advisories apply to customer-managed NetScaler ADC and Gateway appliances. Citrix states that it updates Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself. Secure Private Access Hybrid deployments using NetScaler instances are also covered by the relevant remediation guidance.
Administrators should confirm whether they manage the affected appliance themselves or depend on a provider to apply the update. Do not assume that every cloud deployment has the same patching responsibility.
How Serious Are the NetScaler Vulnerabilities?
The September zero-days are critical because they can allow unauthenticated remote code execution. The potential consequences include unauthorized control of an appliance, disruption of remote access, and a foothold from which an attacker might attempt further activity. The actual impact depends on the deployment, the access available to the compromised appliance, and the attacker’s actions.
A CVSS score helps compare technical severity, but it does not tell an administrator whether their own appliance has been compromised. Exposure, exploitation evidence, business criticality, and available mitigations must all inform the response.
How should administrators prioritize risk?
Use the following order:
- Highest urgency: Appliances running affected builds for CVE-2026-88771 or CVE-2026-88772, particularly where exposure or exploitation is plausible.
- Immediate follow-up: Appliances affected by CVE-2026-88779 or CVE-2026-107406 that have not received the applicable fixes.
- Configuration-specific review: The other September CVEs, using the prerequisites in the official bulletin.
- Validation and monitoring: Confirm the installed builds, verify that remediation succeeded, and investigate suspicious activity where warranted.
This is a practical triage approach, not a replacement for an organization’s formal risk-management process.
How to Check Whether Your NetScaler Deployment Is Exposed
Administrators should establish the software version first, then evaluate each CVE’s configuration requirements. The official Citrix advisories provide the authoritative version conditions and relevant configuration checks.
Step 1: Identify the product and exact build
Record whether the appliance is NetScaler ADC or Gateway, its release branch, and whether it uses a FIPS or NDcPP build. Compare the installed version against the latest applicable fixed-build recommendations.
Include every appliance in the inventory, not just the primary production instance. Separate appliances may run different versions or serve different roles.
Step 2: Check the DTLS configuration
For CVE-2026-88772, Citrix recommends checking whether DTLS is enabled on virtual servers. Its advisory notes that DTLS is enabled by default on VPN virtual servers unless explicitly disabled. Other virtual servers can meet the prerequisite when configured with the DTLS type.
For example, Citrix documents configuration patterns such as -dtls OFF to indicate that DTLS is explicitly disabled on a VPN virtual server. Treat this as a configuration check for the specific CVE, not proof that the appliance is secure against the rest of the vulnerability group.
Step 3: Check SAML configuration for CVE-2026-107406
Citrix identifies two configuration patterns that administrators can use to determine whether SAML roles are configured:
add authentication samlAction– indicates a SAML Service Provider configuration.add authentication samlIdPProfile– indicates a SAML Identity Provider configuration.
The relevant software version determines whether the configuration meets the vulnerability’s prerequisites. A matching configuration entry alone does not establish exposure without the version check.
Step 4: Document the results
For each appliance, record the current build, applicable CVEs, relevant configuration findings, chosen remediation, and validation result. This creates a traceable record for security teams and change management.
How to Patch and Mitigate the Vulnerabilities
The preferred remediation is to install a fixed build recommended by Citrix for the applicable vulnerability and product edition. Configuration changes may reduce exposure in specific circumstances, but they should not be treated as universal substitutes for security updates.
Select the correct update
Before scheduling an upgrade:
- Read the latest applicable Citrix security bulletin.
- Confirm the supported target build for the appliance’s branch and edition.
- Review the vendor’s upgrade and compatibility instructions.
- Plan for any service impact or required maintenance window.
- Confirm that all relevant CVEs, including later disclosures, are covered.
Avoid relying on an old version table copied into a third-party article. Citrix can update its advisories, and later vulnerabilities can require a newer build.
Treat mitigation and patching as different actions
Disabling a feature may change whether a specific vulnerability prerequisite is met. For example, disabling DTLS can change the exposure condition for CVE-2026-88772. It does not fix CVE-2026-88771, which Citrix says affects default configurations without requiring an additional feature.
For this reason, mitigation should be assessed against each CVE independently. Do not declare the appliance safe based on a single configuration change.
Validate after the upgrade
Once the update is complete, verify that the appliance is running the intended build and that required services work correctly. Recheck the relevant advisory and configuration conditions, document the outcome, and continue monitoring for suspicious activity.
If there is credible evidence of compromise, involve the incident-response team rather than treating the upgrade as the only necessary action.
Recommended read: How to Patch Citrix NetScaler in 2026
What Administrators Should Know About the October 2026 Vulnerabilities
The October disclosures change the remediation picture for organizations that addressed the September incidents but have not reviewed subsequent advisories.
CVE-2026-88779: Denial-of-service risk
CVE-2026-88779 is a memory-overflow vulnerability that can cause denial of service. Its published CVSS v4.0 score is 8.7, and the Canadian Centre for Cyber Security reported confirmed exploitation in the wild.
Citrix’s supported CVE dashboard lists the issue among the October vulnerabilities requiring a version scan and upgrade to the recommended build.
Administrators should check the relevant advisory even if they have already addressed the September remote-code-execution vulnerabilities.
CVE-2026-107406: A separate critical memory-overflow vulnerability
CVE-2026-107406 affects qualifying SAML configurations and has a CVSS v4.0 score of 9.5. Citrix recommends 14.1-73.46 or later, 13.1-64.29 or later, and the corresponding fixed FIPS and NDcPP builds.
As of October 14, 2026, the Center for Internet Security’s October 8 advisory reported no known reports of exploitation for CVE-2026-107406. That statement describes the reporting available at the time; it should not be treated as a guarantee that exploitation cannot occur.
If you already installed the September patches
Revisit the installed build against both October advisories. Confirm that the SAML-related conditions for CVE-2026-107406 do not apply, or install the recommended fixed build. Separately verify the applicable remediation for CVE-2026-88779.
Organizations that suspect earlier exploitation should also follow Citrix’s compromise-assessment guidance and preserve relevant evidence before making changes that could affect forensic visibility.
Frequently Asked Questions
1. Is CVE-2026-88771 being actively exploited?
Yes. Citrix’s September 27, 2026, security bulletin states that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed on unmitigated NetScaler deployments. CISA also confirmed active exploitation globally and added both CVEs to its Known Exploited Vulnerabilities catalog. Administrators should treat these issues as urgent remediation priorities.
2. Does disabling DTLS fix all Citrix NetScaler vulnerabilities?
No. Disabling DTLS can change whether the prerequisite for CVE-2026-88772 is met, but it does not address every vulnerability in the September advisory. CVE-2026-88771, for example, affects all deployments covered by the bulletin without requiring an additional feature. Review each CVE’s prerequisites and apply the corresponding vendor-recommended fix.
3. Are cloud-managed NetScaler services affected in the same way?
The cited Citrix bulletins apply to customer-managed NetScaler ADC and Gateway appliances. Citrix says it updates Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself. Organizations using hybrid deployments with customer-managed NetScaler instances should check the applicable advisory and confirm their responsibilities with the service provider.
4. Does upgrading prove that a NetScaler appliance is clean?
No. Upgrading installs a software fix, but it cannot establish whether an attacker accessed the appliance before remediation. If there are signs of unauthorized access, preserve forensic evidence and follow an appropriate incident-response process. CISA specifically advises organizations to consider compromise checks before patching when feasible because updates may reduce forensic visibility.
5. Where should administrators check for the latest fixed builds?
Start with the official Citrix security bulletin for the specific CVE, then consult the NetScaler supported CVE dashboard. Confirm the appliance’s product edition, software branch, configuration prerequisites, and fixed build before making changes. These vendor resources are more reliable for remediation decisions than an undated third-party version list.
The Next Step for NetScaler Administrators
The most important decision is not whether a vulnerability has a critical score; it is whether the relevant appliance is exposed, correctly remediated, and free of evidence requiring further investigation.
Start with the latest Citrix advisories, verify every affected build and configuration, and use the NetScaler supported CVE dashboard to guide ongoing checks. If compromise is suspected, preserve evidence and engage incident response alongside remediation.
Belayet Hossain is a Senior Systems Analyst and Web Infrastructure Expert with a Master’s in Computer Science & Engineering (CSE). Specializing in the “Meta” of the digital world, he applies his engineering background to rigorously test hosting services, domain strategies, and enterprise tech stacks. Belayet translates technical specs into actionable business intelligence. Connect with Belayet Hossain on Facebook, Twitter, or read more about Belayet Hossain.