Citrix has two exploited NetScaler RCE flaws. One needs no feature to be enabled

Citrix published eight vulnerabilities and confirmed attacks against two

Citrix published security bulletin CTX697096 on 27 September 2026 for eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. The list includes remote code execution, denial of service, HTTP request smuggling, policy bypass and predictable TCP sequence numbers.

Two entries change this from a normal patch cycle into incident-response work. Citrix says it has observed exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments. Both score 9.5 under CVSS v4.0 and both can lead to remote code execution, but their exposure conditions are different.

CVE-2026-88771 is the broad one. Citrix describes improper input validation that allows an unauthenticated attacker to execute arbitrary commands. Its precondition is every vulnerable ADC and Gateway deployment, including the default configuration. No optional feature has to be switched on.

CVE-2026-88772 is a memory-overflow flaw that can produce remote code execution or denial of service. It requires DTLS. Citrix warns that DTLS is enabled by default on VPN virtual servers, so the absence of an explicit DTLS virtual-server line does not prove that the precondition is absent.

The two exploited paths have different preconditions and the same operational conclusion

The distinction matters for investigation. A CVE-2026-88771 exposure assessment starts with version and reachability because the vulnerable input path requires no extra feature. A CVE-2026-88772 assessment also needs the running configuration, particularly VPN virtual servers where DTLS remains enabled unless it was explicitly disabled.

The distinction does not change the immediate remediation. Both flaws are being exploited and both are addressed by the fixed builds. Disabling DTLS could remove the stated precondition for CVE-2026-88772, but it does nothing to remove CVE-2026-88771. Citrix's instruction is to install the relevant update as soon as possible.

The other six flaws still matter, but they should not dilute the exploited pair

The eight entries in CTX697096, using Citrix's descriptions and preconditions

CVE	Effect	Stated precondition
CVE-2026-88771	Unauthenticated arbitrary command execution	All vulnerable ADC and Gateway deployments
CVE-2026-88772	Memory overflow leading to RCE or denial of service	DTLS enabled; default on VPN virtual servers
CVE-2026-88773	HTTP request smuggling	HTTP configuration enabled
CVE-2026-88774	HTTP URL expression policy bypass	A policy using an HTTP URL expression
CVE-2026-88775	Memory overflow and denial of service	Gateway or AAA virtual server
CVE-2026-88776	Memory overflow and denial of service	Oracle load-balancing virtual server
CVE-2026-88777	Memory overflow and denial of service	Listed non-HTTP Layer 7 features
CVE-2026-88778	Predictable TCP initial sequence numbers	Listed TCP virtual-server type plus enhanced ISN generation disabled

Every NetScaler ADC and Gateway deployment is affected by at least one entry in the bulletin, according to Citrix. The table is therefore an exposure map, not a reason to postpone the universal update while eight separate risk acceptances are written.

CVE-2026-88774 deserves a separate note for defenders using NetScaler policy rules as a compensating control. Citrix links the flaw to URL normalisation: if a URL is not normalised, it can bypass a WAF or security rule. That is the same defensive lesson seen repeatedly in path-based filters. A control and the protected application must make their decision over the same canonical representation of a request.

Four release lines have fixed builds, and one has an upgrade caveat

Affected and fixed builds stated by Citrix

Release line	Affected	Install at least
NetScaler ADC / Gateway 14.1	Before 14.1-73.37	14.1-73.37
NetScaler ADC / Gateway 13.1	Before 13.1-64.23	13.1-64.23; consider 13.1-64.24 for the caveat below
NetScaler ADC 14.1-FIPS	Before 14.1-73.37 FIPS	14.1-73.37 FIPS
NetScaler ADC 13.1-FIPS / NDcPP	Before 13.1-37.279	13.1-37.279

Citrix says the bulletin applies to customer-managed appliances. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated by Cloud Software Group. Secure Private Access Hybrid deployments using NetScaler instances still need those instances upgraded.

There is an operational trap in the 13.1 branch. Citrix says 13.1-64.23 can enter a cyclic reboot during upgrade under a specific configuration. Its test is show ns variable: no output means the appliance is not susceptible; a list of configured variables means the customer should plan for 13.1-64.24. The caveat is not a vulnerability, but it belongs in the emergency change plan because an availability failure during a security update can turn urgency into rollback.

Updating is the first response action, not evidence that the incident is over

Citrix is making generic indicators of compromise available through NetScaler Console. The capability requires the telemetry channel, appears through the Security Advisory workflow and must be started manually after accepting its terms. Customers without NetScaler Console are directed to Citrix Support.

The vendor also warns that the generic indicators do not cover every attacker technique and may have limited forensic value. That warning is important. A clean vendor scan is one input to an assessment; it is not proof that the appliance was never used. Citrix recommends external log forwarding and file-integrity monitoring, which matter because logs retained only on a compromised edge appliance sit inside the same trust boundary as the event being investigated.

An exploited edge-device vulnerability creates two separate questions: is the vulnerable code still reachable, and was it reached before remediation? The update answers the first. Historical logs, configuration changes, filesystem evidence, authentication records and activity behind the appliance answer the second.

Key facts