Security Advisory 2026-014

Immediate Actions

Key Takeaways

• CVE-2026-88771 requires no preconditions; all NetScaler ADC and Gateway deployments are affected.
• CVE-2026-88772 triggers when DTLS is enabled, which is default on VPN vServer.
• CVE-2026-88773 is an HTTP Request Smuggling flaw requiring HTTP URL-based policy expressions.
• CVE-2026-88778 is a TCP ISN prediction issue mitigated by enabling Enhanced ISN Generation.
• FIPS and NDcPP variants are also affected; Secure Private Access Hybrid deployments must upgrade.

Attack Chain

1. Initial Access: Unauthenticated attacker exploits CVE-2026-88771 or CVE-2026-88772 against internet-facing NetScaler
2. Execution: Memory overflow or input validation flaw triggers remote code execution on appliance
3. Persistence: Attacker establishes foothold on compromised NetScaler appliance
4. Discovery: Attacker enumerates network configuration and connected infrastructure from appliance
5. Exfiltration: Attacker extracts credentials, configuration data, or pivots to internal network

Affected Systems

• Citrix NetScaler ADC 13.1 before 13.1-64.23
• Citrix NetScaler Gateway 13.1 before 13.1-64.23
• Citrix NetScaler ADC and Gateway 14.1 before 14.1-73.37
• Citrix NetScaler ADC FIPS 14.1 before 14.1-73.37 FIPS
• Citrix NetScaler ADC FIPS and NDcPP 13.1 before 13.1-37.279
• Secure Private Access Hybrid using NetScaler instances

Vulnerabilities (CVEs)

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• NetScaler syslog and nslog
• NetScaler CLI audit logs
• Network flow logs (NetFlow/PCAP)
• WAF or reverse proxy logs
• Load balancer health and traffic logs

Key Behavioral Indicators

• Unauthenticated HTTP requests with anomalous headers to NetScaler endpoints
• Unexpected DTLS traffic volume or patterns to VPN vServer
• New admin sessions from previously unseen source IP addresses
• Configuration changes on NetScaler outside maintenance windows
• Unexpected outbound connections from NetScaler appliance IP addresses

Control Gaps

• Network appliances lack EDR coverage for post-exploitation detection
• WAF rules may not detect memory overflow payloads targeting DTLS
• HTTP Request Smuggling may bypass reverse proxy inspection
• TCP ISN prediction exploitation is invisible to application-layer monitoring

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Disable DTLS on VPN vServer if not required to mitigate CVE-2026-88772.
• Remove unnecessary HTTP URL-based policy expressions to reduce CVE-2026-88773 exposure.
• Place NetScaler management interfaces behind VPN or allowlist-based access controls.
• Monitor NetScaler syslog for unexpected configuration changes and admin sessions.

User Protection

• Verify VPN sessions for anomalies following appliance compromise assessment.
• Rotate credentials stored on or accessible through compromised NetScaler appliances.
• Block known attacker infrastructure if compromise is confirmed during assessment.

MITRE ATT&CK Mapping

Plain-Language Summary

Citrix released fixes for eight security flaws in its NetScaler networking products, including two that let attackers run code without a password. Attackers are already using these two flaws in the wild. Organizations running affected versions should update immediately and check internet-facing systems for signs of compromise.