CISA and Australia’s cyber agency have warned that attackers are exploiting two vulnerabilities in Citrix NetScaler ADC and Gateway appliances. Administrators should identify their release branch, check Citrix’s fixed-build guidance and configuration checks, and investigate for signs of compromise—not treat patching alone as proof that an appliance is clean.
What the US and Australian warnings say
Citrix’s advisory covers eight vulnerabilities, CVE-2026-88771 through CVE-2026-88778, affecting customer-managed NetScaler ADC and NetScaler Gateway deployments. On 27 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) said it had added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog, citing reports and partner threat intelligence confirming global active exploitation. CISA described the two as critical zero-days that can independently enable remote code execution.
As an Amazon Associate I earn from qualifying purchases.
Australia’s Australian Signals Directorate’s Australian Cyber Security Centre (ASD/ACSC) published an alert on 28 September and reviewed it on 3 October 2026. It reported confirmed exploitation in Australian organizations after the alert was first published. For Australian organizations, the ACSC recommends reviewing for evidence of compromise dating back to at least 4 September 2026.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhich NetScaler vulnerabilities are being exploited?
The exploitation warning specifically identifies CVE-2026-88771 and CVE-2026-88772. Citrix assigns each a CVSS v4.0 base score of 9.5; these are vendor-reported severity scores, not measurements of how many systems have been compromised.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| CVE | What Citrix says | Exposure condition | Exploitation status in the cited warnings |
|---|---|---|---|
| CVE-2026-88771 | Unauthenticated remote code execution | Citrix says it affects all NetScaler ADC and Gateway deployments; no additional feature requirement is stated. | CISA reported global active exploitation and added it to the KEV catalog. The ACSC reported confirmed exploitation in Australian organizations. |
| CVE-2026-88772 | Memory overflow that can lead to remote code execution or denial of service | DTLS must be enabled. Citrix says DTLS is enabled by default on a VPN virtual server. | CISA reported global active exploitation and added it to the KEV catalog. The ACSC reported confirmed exploitation in Australian organizations. |
| CVE-2026-88773 through CVE-2026-88778 | Six other vulnerabilities included in the same Citrix bulletin | Citrix lists configuration or feature preconditions; check its individual conditions for each CVE. | The cited CISA and ACSC warnings single out CVE-2026-88771 and CVE-2026-88772 as actively exploited. |
For the per-CVE descriptions, configuration conditions, and inspection instructions, consult Citrix bulletin CTX697096. A NetScaler installation may meet the affected-product description without meeting every CVE’s particular exposure condition, so check the configuration rather than assuming all eight apply equally.
Which NetScaler builds contain the fixes?
Citrix lists the following fixed-build floors for the eight-CVE bulletin. Confirm the exact product edition and release branch against the current Citrix bulletin before planning an update.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
| Product and release branch | Fixed build floor listed by Citrix |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 and later 13.1 releases |
| NetScaler ADC 14.1-FIPS | 14.1-73.37 FIPS and later 14.1-FIPS releases |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.279 and later releases |
These are branch-specific floors, not a single build number that applies to every NetScaler edition. Citrix also directs deployments affected by CVE-2026-88778 to enable Enhanced ISN Generation using its TCP configuration guidance. Follow Citrix’s advisory for the correct inspection and remediation steps for your branch and configuration.
Recommended Free Tools
What administrators should do
- Identify the appliance and its branch. Record whether it is ADC or Gateway, the edition (including FIPS or NDcPP where applicable), the installed release, and whether relevant features or virtual-server configurations are present.
- Check Citrix’s advisory and configuration conditions. Use bulletin CTX697096 to match the appliance to the fixed build floor and inspect the conditions for each CVE. In particular, check DTLS for CVE-2026-88772 and review Citrix’s stated virtual-server and feature conditions for the other flaws.
- Look for compromise as well as exposure. Review device logs for suspicious activity and check Citrix’s indicators of compromise through NetScaler Console. Australian organizations should include evidence dating back to at least 4 September 2026, as the ACSC advises.
- If compromise is suspected, preserve evidence before updating. CISA warns that applying an update may reduce forensic visibility. Preserve relevant forensic evidence and follow an incident-response process before patching when compromise is suspected.
- Apply the appropriate fixed build and required configuration guidance. CISA notes that updating NetScaler appliances can be complex and may require downtime. Plan the change for the specific branch and environment, and carry out any additional Citrix-directed configuration action that applies.
- Continue monitoring after the change. Review logs and available indicators for suspicious activity; installing a fixed build does not establish whether an appliance was previously compromised.
What the ACSC’s SAML update means
The ACSC’s 3 October update describes a newly identified issue affecting NetScaler deployments that use SAML authentication. The agency says exploitation may cause system crashes or denial of service and may permit further exploitation. It advises organizations using SAML to review Citrix’s advice and watch for unusual activity.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
The ACSC explicitly says this SAML issue is separate from CVE-2026-88771 and CVE-2026-88772. Do not treat the SAML note as another name for either exploited CVE, or assume it is covered simply by reviewing the two CVEs’ exposure conditions. Check the live Citrix guidance for SAML deployments.
Keep adjacent Citrix advisories separate
Citrix bulletin CTX696939 covers CVE-2026-19489 and CVE-2026-19490, a separate advisory with different affected-build floors and configuration-dependent conditions. It identifies CVE-2026-19490 as an alternate-path authentication bypass whose exposure depends on Gateway or AAA configuration and, for some build ranges, SAML configuration. Do not substitute that bulletin’s build guidance for the fixes in CTX697096; verify the relevant live Citrix bulletin for each issue.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
