NetScaler ADC Vulnerability: Two Critical Flaws Exploited in the Wild

What Happened

Citrix has disclosed two rounds of critical NetScaler ADC vulnerabilities this quarter. On 19 August 2026, Citrix published a security advisory addressing two critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), and told customers to update affected devices as soon as possible.

On 27 September 2026, Citrix published a security bulletin covering 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of them are critical unauthenticated remote code execution flaws, and Citrix has confirmed both are being exploited in the wild. The recommended response is to update the affected software and run a compromise assessment on any device exposed to the internet.

The second advisory changes the risk equation. A critical unauthenticated RCE that is being exploited in the wild means attackers do not need credentials to gain code execution. For MSPs, the practical effect is that every internet-facing NetScaler appliance should be treated as potentially compromised until proven otherwise.

Timeline

• 19 August 2026: Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC and NetScaler Gateway.
• 27 September 2026: Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, including two critical unauthenticated RCE vulnerabilities with confirmed active exploitation.

Who Is Affected

If you run customer-managed NetScaler ADC or NetScaler Gateway, you are in the affected population. The September bulletin specifically covers customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. The August advisory names the same product families.

The September bulletin applies to customer-managed devices only, which is worth checking in your contracts. If a vendor or Citrix manages the appliance, confirm with them that the update and the compromise assessment are complete. If you manage it, the responsibility is yours. Secure Private Access hybrid deployments that use NetScaler instances are also affected.

These products often sit in front of client applications, remote access and VPN traffic. An internet-exposed NetScaler appliance is an attractive target, so treat the affected list as urgent and verify every instance you manage.

NetScaler ADC Vulnerability Technical Details

The two exploited flaws are CVE-2026-88771 (CVSS 9.5), an unauthenticated remote code execution flaw from improper input validation with no precondition, so it affects every deployment, and CVE-2026-88772 (CVSS 9.5), a memory overflow that leads to code execution or denial of service where DTLS is enabled, which is the default on a VPN virtual server. The same bulletin fixes an HTTP request smuggling flaw (CVE-2026-88773), a policy bypass (CVE-2026-88774), three memory overflows (CVE-2026-88775 to 88777) and a TCP sequence number prediction flaw (CVE-2026-88778).

Fixed builds: 14.1-73.37 and 13.1-64.23 for NetScaler ADC and NetScaler Gateway, 14.1-73.37 FIPS, and 13.1-37.279 for FIPS and NDcPP. The August advisory (CVE-2026-19489 and CVE-2026-19490, an authentication bypass rated 9.3) is fixed from 14.1-73.32 and 13.1-63.21, so a device on the September builds has both. Citrix also recommends turning on Enhanced ISN Generation wherever a TCP configuration is enabled.

What to Do This Week

Treat this as a two-part job: patch, then check whether you were already compromised. Here is the order for this week.

1. Update every affected NetScaler ADC and NetScaler Gateway device to 14.1-73.37 or 13.1-64.23 (or the FIPS builds), following the Citrix bulletin for your exact version.
2. Run a compromise assessment on any NetScaler appliance exposed to the internet. Do this even if the device has already been updated.
3. Check your asset inventory for every customer-managed NetScaler ADC and Gateway instance, including test, DR and remote site appliances.
4. Turn on Enhanced ISN Generation on deployments with a TCP configuration enabled.
5. As a standing practice, restrict management access to trusted networks and enforce multi-factor authentication on administrative accounts.
6. Review authentication and VPN logs for unusual activity, such as unexpected source IPs, off-hours logins or new accounts.

What to Tell Clients

Citrix has published a security bulletin for customer-managed NetScaler ADC and NetScaler Gateway. It covers eight vulnerabilities, two of which are critical unauthenticated remote code execution flaws. Citrix has confirmed these two are being actively exploited.

If your environment includes NetScaler ADC or NetScaler Gateway, we are updating those devices and running a compromise assessment because they may have been exposed to the internet.

We will let you know if we find anything suspicious. If you are not sure whether you use these products, ask us and we will check your environment.

The Bottom Line

This is a confirmed, actively exploited vulnerability in products that sit at the edge of client networks. Update affected devices first, then run the compromise assessment. The time to act is this week, not after an incident.

Frequently Asked Questions

Sources

• Citrix security bulletin CTX697096 (Citrix, 27 September 2026)
• Citrix security advisory CTX696939 (Citrix, 19 August 2026)