CVE-2026-88772: Citrix NetScaler ADC RCE Vulnerability

CVE-2026-88772 Overview

CVE-2026-88772 is a memory corruption vulnerability affecting Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway. The flaw, categorized under [CWE-119] (improper restriction of operations within memory buffer bounds), allows unauthenticated network attackers to trigger remote code execution or denial of service against vulnerable appliances. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Critical Impact

Unauthenticated attackers can execute arbitrary code or crash NetScaler appliances across network boundaries, compromising confidentiality, integrity, and availability of edge infrastructure.

Affected Products

• Citrix NetScaler ADC versions before 14.1-73.37 and before 13.1-64.23
• Citrix NetScaler ADC FIPS before 14.1-73.37 FIPS and NDcPP before 13.1.37.279
• Citrix NetScaler Gateway versions before 14.1-73.37 and before 13.1-64.23

Discovery Timeline

• 2026-09-27 - CVE-2026-88772 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-88772

Vulnerability Analysis

The vulnerability resides in memory handling routines of NetScaler ADC and Gateway appliances. Because NetScaler devices are typically deployed as internet-facing load balancers, VPN concentrators, and application gateways, the attack surface is directly reachable from untrusted networks. Successful exploitation grants the attacker control over the appliance, which routinely terminates TLS, brokers authentication, and bridges into internal application tiers.

Citrix's security bulletin groups CVE-2026-88772 with a cluster of related issues (CVE-2026-88771 through CVE-2026-88778), indicating a coordinated patch cycle addressing multiple weaknesses in the same codebase. CISA KEV listing confirms exploitation activity in production environments.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. Code paths processing untrusted network input fail to validate buffer boundaries before read or write operations, enabling adjacent memory to be read, overwritten, or corrupted. Depending on the targeted structure, this corruption yields either process crash (denial of service) or control-flow hijack leading to remote code execution.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the exposed NetScaler management or user-facing interface, triggering the out-of-bounds memory operation. Because NetScaler Gateway deployments commonly expose SSL VPN and ICA proxy endpoints to the public internet, exploitation can originate from any remote host.

No verified public proof-of-concept has been published. Refer to the Citrix Security Bulletin CTX697096 for authoritative technical guidance.

Detection Methods for CVE-2026-88772

Indicators of Compromise

• Unexpected nsppe or management process crashes, core dumps, or restarts in NetScaler system logs.
• Anomalous outbound connections initiated from the NetScaler appliance to attacker-controlled infrastructure.
• New or modified files under /var/tmp, /netscaler/portal/, or web shell artifacts in the Gateway portal directories.
• Unexplained administrative sessions, new local accounts, or configuration changes outside maintenance windows.

Detection Strategies

• Compare running NetScaler build strings against the fixed versions listed in CTX697096 to identify unpatched appliances.
• Inspect HTTP request logs for malformed, oversized, or unusual payloads targeting Gateway and management endpoints.
• Monitor for process crash loops and segmentation faults that indicate memory corruption attempts.
• Correlate authentication telemetry from downstream applications with NetScaler session data to detect session forgery.

Monitoring Recommendations

• Forward NetScaler syslog, audit, and shell command logs to a centralized SIEM for retention and correlation.
• Baseline normal appliance behavior (process set, listening ports, outbound destinations) and alert on deviations.
• Enable packet capture or network detection on management interfaces to retain forensic evidence of exploitation attempts.

How to Mitigate CVE-2026-88772

Immediate Actions Required

• Upgrade NetScaler ADC and Gateway to version 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279 FIPS/NDcPP as applicable.
• Terminate all active ICA and PCoIP sessions after upgrade using kill icaconnection -all and kill pcoipConnection -all to invalidate potentially hijacked sessions.
• Review NetScaler configurations, administrator accounts, and session tokens for signs of unauthorized modification.
• Restrict management interface exposure to trusted administrative networks only.

Patch Information

Citrix released fixed builds in security bulletin CTX697096 covering CVE-2026-88771 through CVE-2026-88778. Customers on End-of-Life branches (12.1 and 13.0) must migrate to a supported release because no fixes are provided for unsupported versions. See the Citrix Security Bulletin CTX697096 and the CISA KEV entry for authoritative remediation guidance.

Workarounds

• No vendor-approved workaround exists; patching is the only supported remediation.
• Place NetScaler management interfaces behind a jump host or VPN with strict ACLs until patching completes.
• Deploy upstream WAF or IPS rules to block malformed requests to NetScaler Gateway endpoints as a compensating control.
• Rotate credentials, certificates, and API keys stored on or terminated by the appliance if compromise is suspected.

# Verify installed NetScaler build and terminate active sessions post-upgrade
show ns version
kill icaconnection -all
kill pcoipConnection -all