NetScaler ADC and Gateway operators have two newly disclosed flaws to handle on the same appliance fleet. CISA added CVE-2026-88771 to its exploited-vulnerabilities catalog on September 27: improper input validation can let an unauthenticated attacker run arbitrary commands. The NetScaler-assigned record identifies branch-specific affected builds; CISA sets September 30 as the federal action deadline and calls for forensic triage.
A second NetScaler-assigned record, CVE-2026-88772, describes a memory overflow that can cause remote code execution or denial of service on the same ADC and Gateway release branches. CISA’s enrichment of that record marks it as actively exploited too. This is a fresh September 27 pair, separate from the earlier NetScaler authentication-bypass and memory-overflow CVEs. Owners of customer-managed appliances should map both identifiers to installed builds before using an older patch decision as their answer.
Two flaws share release floors
The first flaw is an input-validation failure with unauthenticated arbitrary-command execution as its stated consequence. The second is a memory overflow with remote code execution or service disruption as its stated consequences. The NetScaler CVE record assigns CVE-2026-88771 a network attack vector with no privileges or user interaction, but also marks attack requirements as present. Treat reachable ADC and Gateway deployments as urgent while following the current Citrix guidance for any configuration-dependent exposure details.
For ordinary ADC and Gateway releases, the affected versions are those before 14.1-73.37 on the 14.1 branch and before 13.1-64.23 on the 13.1 branch, for both CVEs. ADC’s FIPS releases have their own boundaries: before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP. The vendor’s CVE entries give these as affected-version cutoffs, so compare the full installed build and edition, rather than just the major branch. An ADC in the FIPS/NDcPP line needs the matching FIPS/NDcPP comparison, not the ordinary Gateway floor.
Figure details
The figure titled “Two NetScaler response paths” shows a NetScaler ADC and Gateway card marked “Two exploited CVEs.” Two arrows leave that card. The left arrow leads to “Affected build,” followed by “Check full build” and “Use Citrix guidance.” The right arrow leads to “Compromise signs,” followed by “Save Console logs” and “Isolate and rebuild.” The branches stay separate: a version comparison guides the upgrade path, while suspected compromise calls for evidence preservation and recovery.
Use the current Citrix bulletin referenced by the CVE record for the applicable upgrade and mitigation instructions. Get the bulletin through Citrix support before declaring an appliance remediated if the public article is inaccessible to your team; use the CVE version list to scope exposure in the meantime.
Console indicators guide triage
CISA’s entry says: “Running the provided IOCs in the NetScaler console may help identify indicators of exploitation.” Obtain those indicators from Citrix’s current guidance and run the supported check in NetScaler Console. Preserve the resulting findings with the appliance inventory, build, edition, and internet-exposure assessment. A clean indicator search is one input to triage, while an appliance matching a suspicious indicator needs the incident-response path.
CISA calls for forensic triage alongside vendor mitigation. On a suspected compromised VPX, Citrix’s response guide starts with a snapshot and records of system time, timezone, and NTP configuration. Preserve local logs plus remote syslog and NetScaler Console logs before isolation. Coordinate packet-engine memory capture with responders: Citrix warns that producing its core file causes a warm restart and disconnects SSH sessions.
That guide then calls for network isolation, rotation of stored service-account secrets and affected users’ credentials on their respective systems, and revocation of certificates and private keys on the suspected appliance. Investigate connected authentication, web-tier, sensitive, and management systems. For VPX, Citrix recommends replacing the instance; upgrade firmware before restoring a known-good, pre-compromise configuration backup, then rotate restored local passwords and key-encryption keys and replace the revoked certificates. This is a suspected-compromise workflow, not a reason to rebuild every appliance solely because its build is old.
Match builds, then preserve evidence
Inventory ADC and Gateway instances by edition, full installed build, and reachable service surface; compare each with the corresponding 14.1, 13.1, or ADC FIPS/NDcPP floor above. Apply Citrix’s current mitigation or upgrade instructions to affected appliances, and restrict unnecessary internet reachability while the change is coordinated. CISA tells asset owners to evaluate each appliance’s internet exposure, and sets September 30 for federal remediation under its risk-based directive.
On an appliance with compromise indicators, collect the Console and syslog evidence and involve incident response before disruptive recovery. Citrix’s guidance also says NetScaler management services should never face the public internet; verify that management access is restricted independently of the service-exposure assessment. After upgrading, record the running build and edition on each appliance and compare them with the vendor’s branch-specific floor. For a suspected compromised unit, also confirm that the replacement, credential and certificate work covers the connected systems the old appliance could reach. A fixed build addresses the vulnerability; the preserved evidence and recovery work address what an attacker may already have done.