5 mincritical
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
Active exploitation of Citrix NetScaler ADC and Gateway vulnerabilities CVE-2026-88771 and CVE-2026-88772 enables unauthenticated remote command execution and DoS; patch immediately. Eight vulnerabilities affect customer-managed Citrix NetScaler ADC and Gateway. Two are actively exploited: CVE-2026-88771 allows unauthenticated remote command execution, and CVE-2026-88772 causes buffer overflow leading to RCE or DoS. Isolate and patch affected systems.
Sens:■ ImmediateConf:
IOCs8
8cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Isolate affected NetScaler systems and restrict access to trusted IP ranges.
- Install the latest available updates from Citrix immediately.
- Investigate for compromise using IOCs published in the Citrix blog.
- Replace compromised systems with new, fully patched appliances.
Key Takeaways
- CVE-2026-88771 and CVE-2026-88772 are confirmed as actively exploited in the wild.
- Eight total vulnerabilities disclosed affecting Citrix NetScaler ADC and Gateway.
- Affected versions include 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23.
- Citrix blog contains IOCs for investigating potential compromise.
- NetScaler Console File Integrity Monitoring can detect unauthorized file changes.
Attack Chain
- Initial Access: Unauthenticated attacker targets exposed Citrix NetScaler ADC or Gateway.
- Exploitation: Attacker exploits CVE-2026-88771 or CVE-2026-88772 to execute commands or code.
- Impact: Remote code execution, denial of service, or security control bypass achieved.
- Post-Exploitation: Attacker may modify files or establish persistence on the appliance.
Affected Systems
- Citrix NetScaler ADC 14.1 before 14.1-73.37
- Citrix NetScaler Gateway 14.1 before 14.1-73.37
- Citrix NetScaler ADC 13.1 before 13.1-64.23
- Citrix NetScaler Gateway 13.1 before 13.1-64.23
- Citrix NetScaler ADC FIPS before 14.1-73.37 FIPS
- Citrix NetScaler ADC FIPS and NDcPP before 13.1-37.279
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway | Critical | Unauthenticated remote attacker executes arbitrary commands via improper input validation. |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway | Critical | Buffer overflow leads to remote code execution or denial of service. |
| CVE-2026-88773 | Citrix NetScaler ADC and Gateway | High | HTTP request/response smuggling manipulates or bypasses security controls. |
| CVE-2026-88774 | Citrix NetScaler ADC and Gateway | Medium | Improper HTTP URL expression usage causes feature policy bypass. |
| CVE-2026-88775 | Citrix NetScaler ADC and Gateway | Medium | Memory overflow causes unpredictable behavior or denial of service. |
| CVE-2026-88776 | Citrix NetScaler ADC and Gateway | Medium | Memory overflow causes unpredictable behavior or denial of service. |
| CVE-2026-88777 | Citrix NetScaler ADC and Gateway | Medium | Memory overflow causes unpredictable behavior or denial of service. |
| CVE-2026-88778 | Citrix NetScaler ADC and Gateway | Medium | Predictable exact value allows attacker to influence integrity or availability. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR may see process execution and file modifications on NetScaler appliances if instrumented. |
| Network Visibility | High | Exploitation targets public-facing appliances; network logs show attack traffic. |
| Detection Difficulty | Moderate | Requires parsing NetScaler-specific logs and correlating with published IOCs. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for unauthenticated command execution on NetScaler appliances originating from external IPs (T1190, T1059). | NetScaler appliance logs, network firewall logs. | Initial Access | Low — unauthenticated commands from external IPs are abnormal. |
| Hunt for unexpected file modifications on NetScaler appliances indicating post-exploitation (T1190). | NetScaler Console File Integrity Monitoring. | Persistence | Medium — legitimate updates may trigger file integrity alerts. |
Required Log Sources
- NetScaler appliance logs
- Web application firewall logs
- Network firewall logs
- NetScaler Console File Integrity Monitoring
Key Behavioral Indicators
- Unauthenticated command execution from external sources
- Unexpected file modifications on NetScaler appliances
- HTTP request smuggling patterns in web logs
- Anomalous memory usage or crashes on NetScaler
Control Gaps
- Lack of network segmentation for NetScaler appliances
- Missing File Integrity Monitoring on NetScaler instances
- Insufficient logging on NetScaler appliance management interfaces
False Positive Assessment
Low — Exploitation of these vulnerabilities produces distinct command execution and file modification patterns on NetScaler appliances.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict access to NetScaler management interfaces to internal IP ranges only.
- Enable NetScaler Console File Integrity Monitoring on all instances.
- Deploy upstream firewalls to filter traffic to exposed NetScaler appliances.
User Protection
- Monitor for and report suspicious activity on Citrix NetScaler portals.
- Ensure administrators use strong, unique credentials for appliance access.
Security Awareness
- Review and follow NCSC guidance on vulnerability management practices.
- Sign up for NCSC Early Warning service for threat notifications.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Impact
Plain-Language Summary
Attackers are actively exploiting security flaws in Citrix NetScaler ADC and Gateway products. These flaws allow unauthorized individuals to run commands remotely or crash systems. Organizations using on-premises Citrix NetScaler should immediately isolate affected systems, check for compromise using indicators from Citrix, and install the latest updates.
Showing defanged values
- cveCVE-2026-88771Unauthenticated remote attacker executes arbitrary commands via improper input validation.
- cveCVE-2026-88772Buffer overflow leads to remote code execution or denial of service.
- cveCVE-2026-88773HTTP request/response smuggling manipulates or bypasses security controls.
- cveCVE-2026-88774Improper HTTP URL expression usage causes feature policy bypass.
- cveCVE-2026-88775Memory overflow causes unpredictable behavior or denial of service.
- cveCVE-2026-88776Memory overflow causes unpredictable behavior or denial of service.
- cveCVE-2026-88777Memory overflow causes unpredictable behavior or denial of service.
- cveCVE-2026-88778Predictable exact value allows attacker to influence integrity or availability.