Citrix fixed eight NetScaler flaws in one bulletin. The federal three-day clock covers two, and neither is the highest scored

Eight flaws, one bulletin, two deadlines

Citrix published security bulletin CTX697096 on 27 September 2026, covering eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, CVE-2026-88771 through CVE-2026-88778. Citrix states that exploits of two of them, 88771 and 88772, have been observed against unmitigated deployments.

CISA added those same two to the Known Exploited Vulnerabilities catalogue the same day, with a due date of 30 September. That is a three-day clock under BOD 26-04, and both records are flagged for forensic triage.

The fixed releases are 14.1-73.37 and 13.1-64.23, with matching FIPS and NDcPP builds. One flaw, 88778, a TCP initial sequence number prediction issue, also needs a configuration change: Citrix tells affected deployments to turn on Enhanced ISN Generation.

Citrix scores all eight with CVSS v4.0. NVD has added its own CVSS 3.1 scores for five of them. Put the two systems side by side and the flaws on the federal clock are not the ones either system rates highest overall.

• 88771, input validation leading to unauthenticated command execution: v4.0 9.5, NVD 3.1 9.8. In KEV.
• 88772, memory overflow when DTLS is on: v4.0 9.5, NVD 3.1 8.1. In KEV.
• 88773, HTTP request smuggling: v4.0 9.3, NVD 3.1 10.0. Not in KEV.

The highest score anywhere in the set is NVD's 10.0 for 88773. The lower of the two KEV entries scores 8.1 on the same NVD scale, which puts it in the High band rather than Critical. Under Citrix's v4.0 scores the order flips, with both KEV entries at 9.5 and 88773 just below.

What that does not establish, and this matters more than the arithmetic. It does not mean CISA got it wrong. KEV lists vulnerabilities with evidence of exploitation, and Citrix itself reports exploitation of 88771 and 88772 only. On KEV's own terms, the selection is exactly right. It does not mean 88773 is being exploited, and nothing published says it is. And the ranking disagreement is between two scoring systems applied by two different organisations, not an error in either one.

The mistake would be reading KEV as a priority ranking. A three-day federal deadline makes that easy to do: the two CVEs with a date attached look like the two that matter, and the other six look like they can wait.

The preconditions are where the real exposure is

Citrix's bulletin gives a precondition for each flaw, and those say more about exposure than the scores do.

88771 needs nothing. In Citrix's words it affects "All NetScaler ADC and NetScaler Gateway deployments", including those on the default configuration.

88772 needs DTLS, which Citrix notes is enabled by default on a VPN virtual server. A Gateway is exposed unless DTLS has been explicitly switched off.

88773, the one not on the clock, needs an HTTP configuration: any load balancing, content switching, VPN or authentication virtual server of type HTTP or SSL. That describes most deployments of a product whose job is to sit in front of web applications.

All eight, with what each one needs to be reachable

Two of eight are on the federal clock, and the highest NVD score, 10.0 for request smuggling, is not one of them. Citrix v4.0 scores and preconditions from bulletin CTX697096 of 27 September; NVD 3.1 scores as of 28 September. Only 88771 and 88772 have observed exploitation, per Citrix. CVE numbers are shortened: 88771 is CVE-2026-88771, and so on.

CVE and flaw	Precondition, per Citrix	v4.0 / NVD 3.1	In KEV
88771, input validation, command execution	None. Default configuration	9.5 / 9.8	Yes, due 30 Sep
88772, memory overflow, RCE or DoS	DTLS, on by default for VPN	9.5 / 8.1	Yes, due 30 Sep
88773, HTTP request smuggling	Any HTTP or SSL virtual server	9.3 / 10.0	No
88774, policy bypass	URL-based policy expressions	7.0 / 7.2	No
88775, memory overflow, DoS	Gateway or AAA virtual server	8.8 / 9.8	No
88776, memory overflow, DoS	Oracle load balancing virtual server	8.8 / no NVD score	No
88777, memory overflow, DoS	Non-HTTP layer 7 features	8.8 / no NVD score	No
88778, TCP ISN prediction	TCP virtual servers	8.8 / no NVD score	No

A smaller problem in the catalogue record itself

The KEV record for CVE-2026-88771 lists its weakness as CWE-119, improper restriction of operations within the bounds of a memory buffer. That is the weakness of its sibling, 88772. Citrix's bulletin gives 88771 as CWE-20, improper input validation, and so does NVD. The KEV record's own name field agrees with Citrix: "Citrix NetScaler Improper Input Validation Vulnerability".

The same record's notes field ends with a link to NVD for CVE-2026-88772, not 88771. So two fields in one record carry the sibling's data.

Neither error changes what anyone should do, and the deadline is correct. But this is the second KEV record in a week whose own fields disagree with each other, after the WSO2 entry covered in an earlier briefing. Anyone who pulls the CWE field from the feed into a report is carrying the wrong one for this CVE.

What to do about it

The question this leaves

CISA did its job here. Two flaws were being exploited, and two flaws went on the clock within a day. The difficulty is what happens next in the organisations that read the catalogue: the deadline makes those two feel like the story, when the product had eight flaws and one fix.

So the question for your own process: when an advisory lists eight vulnerabilities and a regulator puts a date on two of them, which number decides what your team does on Monday morning?