On September 27, 2026, NVD published six Citrix NetScaler ADC and NetScaler Gateway CVEs within the same hour. The same day, CISA added two of them to its KEV catalog, with a deadline of September 30 — three days.
The most serious, CVE-2026-88771, lets an unauthenticated attacker execute arbitrary commands. It's rated 9.8, and it's being exploited.
The good news: for once, the NVD description explicitly gives the fixed versions. A single upgrade covers all six CVEs.
The Six CVEs
| CVE | Type | CVSS 3.1 | Vector | CISA KEV |
|---|---|---|---|---|
| CVE-2026-88771 | Improper input validation → command execution | 9.8 CRITICAL | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | yes (09/27) |
| CVE-2026-88772 | Memory flaw → RCE or denial of service | 8.1 HIGH | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | yes (09/27) |
| CVE-2026-88773 | HTTP request smuggling | 10.0 CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | no |
| CVE-2026-88775 | Memory overflow | 9.8 CRITICAL | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | no |
| CVE-2026-88776 | Memory overflow | 9.8 CRITICAL | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | no |
| CVE-2026-88777 | Memory overflow | 9.8 CRITICAL | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | no |
All published by NVD on 2026-09-27. CISA deadline for both KEV entries: 2026-09-30.
Notice that the highest-rated CVE in the batch (88773, 10.0) isn't in KEV, while the 8.1 is. KEV says nothing about theoretical severity: it says what is actually being exploited. That's the column to read first.
CVE-2026-88771 — Command Execution Without Authentication
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway [...] leading to an unauthenticated attacker to execute arbitrary commands.
No account, no user interaction, low complexity. On a NetScaler Gateway, the affected interface is internet-facing by design: it's the entry point for remote access. An attacker running commands on that box sits in the middle of VPN and ICA sessions, with access to the configuration, certificates and directory secrets it holds.
CVE-2026-88772 — Memory Flaw, RCE or DoS
NVD doesn't name the weakness class precisely (CISA calls it improper restriction of operations within the bounds of a memory buffer). The vector shows AC:H: exploitation requires specific conditions, hence the 8.1. That hasn't stopped it from being exploited in the wild.
CVE-2026-88773 — HTTP Request Smuggling, 10.0
HTTP smuggling comes from two components disagreeing on where a request ends. On an ADC acting as a reverse proxy in front of applications, that disagreement can let a hidden request ride behind a legitimate one: bypassing controls enforced at the front, or poisoning responses served to other users. The S:C reflects this: the impact spills from the appliance into the applications it protects.
CVE-2026-88775, 88776, 88777 — Memory Overflows
Three nearly identical descriptions: memory overflow leading to "unpredictable or erroneous behavior" or denial of service. NVD still rates them 9.8 with full confidentiality and integrity impact. I won't read more into it than that: the Citrix advisory is authoritative on the details.
Versions
The NVD description explicitly gives the versions before which the product is vulnerable — that is, the fixed versions:
| Product | Branch | Fixed version |
|---|---|---|
| NetScaler ADC and Gateway | 14.1 | 14.1-73.37 |
| NetScaler ADC and Gateway | 13.1 | 13.1-64.23 |
| NetScaler ADC FIPS | 14.1 | 14.1-73.37 FIPS |
| NetScaler ADC FIPS and NDcPP | 13.1 | 13.1-37.279 |
NVD writes the last bound as either 13.1.37.279 or 13.1-37.279 depending on the entry. Check the exact build for your variant in the Citrix advisory. Branches not listed (end-of-life releases) aren't mentioned by NVD: if you run one, treat it as unpatched.
Detection
- Unexpected processes or shell commands on the appliance outside documented administration
- Recently modified or added files in web and configuration directories outside updates
- Restarts or crashes of the packet processing engine: an exploited memory overflow, even a failed attempt, often leaves this trace
- Accounts, SSH keys or configuration changes that don't appear in your change management
- On the applications behind the ADC: inconsistent responses or requests the front end never logged
Mitigation
- Upgrade to 14.1-73.37 or 13.1-64.23 (or the matching FIPS / NDcPP build) on every appliance, including secondary cluster or HA nodes. The CISA deadline is September 30.
- Start with internet-facing Gateways: that's where 88771 plays out.
- After upgrading, consider terminating active sessions to start from a clean state — common practice after past NetScaler memory flaws. Follow the Citrix advisory if it gives specific steps.
- Restrict the management interface (NSIP) to admin networks. It should never be reachable from the internet.
- If you suspect compromise: an upgrade doesn't remove access that's already in place. Review accounts, keys and configuration, and rotate secrets stored on the appliance (LDAP bind accounts, certificates).
This isn't NetScaler's first KEV entry this month: an authentication bypass was added on September 9 — see our article on CVE-2026-19490.
Why Continuous Monitoring of Edge Devices Matters
A NetScaler is both internet-facing and at the heart of remote access authentication. Two KEV entries on their publication day, with three days to patch, leave little room for anyone who first has to work out which appliances run which build.
With cveo.tech, inventory your edge devices with exact versions, and get alerted as soon as a CISA KEV CVE affects them.