Back Yorku.Ca

Citrix NetScaler ADC/Gateway RCE Vulnerabilities (CVE-2026-88771 & CVE-2026-88772)

Yorku.Ca • October 6, 2026

A recently disclosed set of vulnerabilities (CVE-2026-88771 and CVE-2026-88772) affects Citrix NetScaler ADC and Citrix NetScaler Gateway and may allow unauthenticated remote attackers to execute arbitrary code on vulnerable appliances. Severity level: CVSS Score: 9.5/Critical. Description:

CVE-2026-88771 is an improper input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw could allow an unauthenticated attacker to execute arbitrary commands remotely against affected appliances. The vulnerability impacts default NetScaler deployments and does not require any special configuration to be exploitable.

CVE-2026-88772 is a memory overflow vulnerability that may allow remote code execution or denial-of-service attacks. The issue affects systems where DTLS is enabled, which is the default configuration for VPN virtual servers on NetScaler Gateway deployments.

NetScaler ADC and Gateway prior to 14.1-73.37

NetScaler ADC and Gateway prior to 13.1-64.23

NetScaler ADC FIPS prior to 14.1-73.37

NetScaler ADC FIPS and NDcPP prior to 13.1-37.279

Successful exploitation may allow attackers to gain unauthorized access to NetScaler infrastructure.

Upgrade immediately to the following fixed versions:-

NetScaler ADC / Gateway 14.1-73.37 or later

NetScaler ADC / Gateway 13.1-64.23 or later

13.1-37.279 FIPS and NDcPP

UIT Information Security

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a CVSS score of 9.5. Attackers utilized custom web shells named WHIPSHOT and SLAPSHOT to gain unauthorized access to affected systems. Organizations in sectors such as government, finance, and healthcare were particularly vulnerable. Citrix has since released patches for these vulnerabilities, but the urgency of the situation has raised concerns about the effectiveness of their response. The incidents highlight the ongoing risks associated with internet-exposed edge devices and the need for rapid incident response. As of October 4, 2026, the exploitation is confirmed to be ongoing, with significant operational and compliance risks reported. 78 sources 80

Extracted Entities

Citrix NetScaler ADC/Gateway RCE Vulnerabilities (CVE-2026-88771 & CVE-2026-88772)

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)