Zero Radar
← feed
CriticalVulnerabilityCVE-2026-88772updated 25 Oct 2026, 18:25 UTC

Citrix NetScaler ADC and Gateway can be hijacked remotely by unauthenticated attackers

Attackers on the internet can send specially crafted traffic to Citrix NetScaler devices and run their own code on them, or crash them. Attackers are already doing this in the wild.

Exploited (CISA KEV, CERT-EU)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 9.5 of 10
Being exploited?YesConfirmed by CISA KEV, CERT-EU · 27 Sept 202
Fix available?YesUpgrade to NetScaler ADC 14.1-73.37 or later, or 13.1-64.23 or later, and the corresponding FIPS/NDcPP builds (14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP) per Citrix's 27 September 2026 security bulletin. · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerScans the internet for exposed devices
  2. 2Crafted requestSends malicious traffic with no login needed
  3. 3NetScaler deviceMemory buffer overflow is triggered
  4. 4Code executionAttacker runs commands on the appliance
  5. ResultAttacker controls the NetScaler device

What happened

A memory buffer bounds flaw (improper restriction of operations within a memory buffer) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated remote code execution or denial of service.

Why it is dangerous: A successful attacker could take control of an internet-facing NetScaler appliance, which sits at the entry point of a network and may handle logins and traffic for many users. Organisations with internet-exposed NetScaler devices are most at risk.

Are you affected?

You are affected if you run customer-managed Citrix NetScaler ADC or NetScaler Gateway on versions before 14.1-73.37, before 13.1-64.23, the FIPS builds before 14.1-73.37 FIPS or 13.1.37.279 FIPS, or the NDcPP builds listed by Citrix.

NetScaler ADC: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP. NetScaler Gateway: before 14.1-73.37; before 13.1-64.23.

What to do

  1. Update NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23 (or the matching FIPS/NDcPP build) as specified in Citrix's security bulletin.
  2. Restrict management and internet exposure of NetScaler devices wherever possible, following Citrix's vendor mitigation instructions if patching is delayed.
  3. Run a compromise assessment on any NetScaler device that was internet-exposed and unpatched, following CISA's forensics triage requirements.
  4. Prioritise this patch under CISA BOD 26-04 based on each device's internet exposure.

Timeline

  1. 27 Sept 2026, 00:00 UTC
    Publicly disclosed
  2. 27 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 15:20 UTC
    Reported by CERT-EU · CERT-EU
  4. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to NetScaler ADC 14.1-73.37 or later, 13.1-64.23 or later, 13.1.37.279 FIPS and NDcPP or later, and NetScaler Gateway 14.1-73.37 or later, 13.1-64.23 or later. Apply vendor mitigations where patches cannot be applied immediately.
  6. 25 Oct 2026, 18:25 UTC
    CERT-EU reported on it · CERT-EU

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-88772 · GHSA-h5xm-pf48-4c32 · ZR-cfbeb8a4 · ZR-9fc8e3de
CVSS
9.5 / 10
EPSS
78% chance of exploitation within 30 days
Disclosed
27 Sept 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:25 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Citrix NetScaler ADC and Gateway can be hijacked remotely by unauthenticated attackers · Zero Radar