Remote Code Execution and Denial of Service Vulnerabilities in Citrix NetScaler Products
CVE-2026-88772

9.5CRITICAL

Key Information:

Vendor

Citrix Netscaler

Status
Adc
Gateway
Vendor
CVE Published:
27 September 2026

Badges

📈 Trended📈 Score: 3,320💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2026-88772?

CVE-2026-88772 is a serious security vulnerability affecting Citrix NetScaler products, specifically the NetScaler ADC and NetScaler Gateway. These products play a crucial role in application delivery and secure remote access, widely utilized by organizations to enhance performance and secure their network infrastructure. The vulnerability allows attackers to exploit remote code execution capabilities, enabling them to execute arbitrary code on compromised systems. Additionally, it poses a risk of denial of service, potentially rendering affected devices inoperable. The versions at risk include those prior to 14.1-73.37 and 13.1-64.23 for both the ADC and Gateway products, indicating that organizations using outdated software are particularly susceptible to attack.

Potential impact of CVE-2026-88772

  1. Remote Code Execution: The vulnerability facilitates unauthorized access, allowing attackers to execute malicious code on the affected systems. This poses an immediate threat to the integrity and confidentiality of organizational data.

  2. Denial of Service: This vulnerability can lead to service interruptions, making critical applications and services unavailable. Such downtime not only disrupts business operations but can also lead to financial losses and damage to reputation.

  3. Increased Risk of Further Exploitation: With remote code execution capabilities, attackers could potentially use compromised systems as footholds to launch further attacks within the organization, leading to broader security breaches and data compromises.

CISA has reported CVE-2026-88772

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-88772 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

ADC 0 < 14.1-73.37

ADC 0 < 13.1-64.23

ADC 0 < 14.1-73.37 FIPS

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88772
Created by murrez

News Articles

favicon imageCybersecuritynews

CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely

Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, allowing them to execute code remotely on exposed systems.

1 week ago

favicon imageThis Week In 4n6

Week 41 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Forensic Acquisition of MediaTek-Based Android Devices Vladimir Katalov at Elcomsoft Low-Level Extraction of the HomePod mini Eoghan Casey at DFRWS G...

2 weeks ago

favicon imageThis Week In 4n6

Week 40 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Adam at Hexacorn The boring state of stalled timelines… Belkasoft Analyzing Windows BAM and DAM with Belkasoft X Christopher Eng at Ogmini Steam Frame - DFIR F...

3 weeks ago

References

https://support.citrix.com/support-home/kbsearch/article?...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 💰

    Used in Ransomware

  • 🟡

    Public PoC available

  • 📰

    First article discovered by Securityweek

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.