NetScaler ADC is the broader application-delivery platform; NetScaler Gateway is a remote-access capability that can be configured on an ADC appliance. They are related roles, not mutually exclusive hardware categories. Whether an appliance needs a particular security update depends on its build and edition, its configuration, and the scope of the latest Citrix advisory.
What is the difference between NetScaler ADC and NetScaler Gateway?
NetScaler ADC is the broader product family for application-delivery functions. Gateway provides an authenticated route through the appliance to internal resources, including applications, desktops, file servers, and websites. A deployment can therefore use an ADC appliance with Gateway functionality; the labels do not necessarily describe two separate boxes.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Server Motherboard for Citrix NetScaler X9SPU-F-CS045 1155 Fully Tested | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What Gateway does
In Citrix’s NetScaler Gateway 14.1 documentation, a Gateway virtual server represents services available to users and acts as their access point. Authentication and authorization policies govern sign-in and which resources a user may reach. Depending on the deployment, access can use Citrix Secure Access, Citrix Workspace app, mobile clients, or clientless access. A typical deployment places Gateway in a DMZ. (Citrix, About NetScaler Gateway, accessed October 4, 2026.)
Free tools Windows power users keep installed
One-click scans. No signup required.
Why the distinction matters for security
Some vulnerabilities apply broadly to ADC and Gateway deployments, while others require particular features or settings—such as a Gateway mode, an AAA virtual server, or enabled DTLS. A system’s actual configuration, not just its product label, determines whether many of the advisory’s conditions are present.
#1 Best Overall
- Server Motherboard For Citrix NetScaler X9SPU-F-CS045 1155 Fully Tested
Which NetScaler systems need security updates?
For customer-managed appliances, first use Citrix’s latest security bulletins to determine the fixed build for the relevant branch and edition. Citrix’s September 27, 2026 bulletin, CTX697096, covered eight vulnerabilities in customer-managed NetScaler ADC and Gateway. It reported observed exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments.
September 27, 2026 bulletin: vulnerabilities and applicability
The table summarizes Citrix’s stated prerequisites and CVSS v4.0 base scores in CTX697096. “All deployments” below means the bulletin lists no additional feature or configuration prerequisite; it does not mean every system is necessarily unpatched or compromised.
| Vulnerability | Citrix description and prerequisite | CVSS v4.0 base score |
|---|---|---|
| CVE-2026-88771 | Unauthenticated remote code execution due to improper input validation; all ADC and Gateway deployments, including default configurations. | 9.5 |
| CVE-2026-88772 | Memory overflow that can lead to remote code execution or denial of service; DTLS must be enabled. Citrix says DTLS is enabled by default on VPN virtual servers. | 9.5 |
| CVE-2026-88773 | HTTP configuration. | 9.3 |
| CVE-2026-88774 | URL-based policy expressions. | 7.0 |
| CVE-2026-88775 | Gateway mode (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or an AAA virtual server. | 8.8 |
| CVE-2026-88776 | Oracle-type load balancing. | 8.8 |
| CVE-2026-88777 | Specific non-HTTP Layer 7 functionality in LB/CS or CGNAT-LSN/NAT64 deployments. | 8.8 |
| CVE-2026-88778 | TCP configuration with Enhanced ISN Generation disabled. Citrix also specifies a TCP configuration change for impacted deployments. | 8.8 |
Fixed-version thresholds listed in CTX697096
These are the thresholds listed for that September 27 bulletin, not a universal statement of the latest safe build for every later advisory.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Product or edition | Fixed threshold listed by Citrix |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 and later releases |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 and later 13.1 releases |
| NetScaler ADC 14.1-FIPS | 14.1-73.37 FIPS and later 14.1-FIPS releases |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.279 and later releases |
October 3 history entry: check CTX697174
NetScaler 14.1 documentation history records an October 3, 2026 entry associating build 14.1-73.41 and later with vulnerabilities described in CTX697174; the entry also says 14.1-73.41 replaced FIPS build 14.1-73.37. The available history entry does not state CTX697174’s vulnerability list, configuration prerequisites, or all branch- and edition-specific thresholds. Administrators should consult CTX697174 itself and confirm the applicable build rather than assume CTX697096’s scope or thresholds also apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to determine what to update
- Inventory each appliance. Record whether it is customer-managed, its role and enabled features, software branch and exact build, and edition—including FIPS or NDcPP where applicable.
- Inspect the configuration against each advisory. For CTX697096, check Gateway or VPN modes, AAA virtual servers, DTLS, HTTP, URL-based policy expressions, load-balancing type, relevant Layer 7 or CGNAT features, and the TCP Enhanced ISN Generation setting. Do not treat all eight entries as having the same applicability.
- Check the current bulletin for the matching branch and edition. Review CTX697096 for its listed fixes and CTX697174 for the October 3 history entry. Confirm any subsequent vendor guidance before selecting a target build.
- Verify the change and follow-up. After upgrading, confirm the appliance reports the intended build. Apply any configuration changes or incident-response steps required by the relevant bulletin; seek Citrix Technical Support if assistance is needed.
Customer-managed appliances and Citrix-managed services are different
CTX697096 applies to customer-managed ADC and Gateway appliances. Citrix says Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by Cloud Software Group. Do not apply the customer-managed appliance version list to a managed service; use the service’s own guidance. The bulletin’s scope identifies affected product and configuration conditions, but does not establish whether a particular organization’s appliance is compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
