CVE-2026-88778: 
Citrix ADC VPX Analyse et atténuation des vulnérabilités

CVE-2026-88778 is a predictable exact value from previous values vulnerability (CWE-342) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. It allows unauthenticated remote attackers to predict cryptographic values based on previous outputs, potentially bypassing security mechanisms that rely on unpredictable random values. Affected versions include NetScaler ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; and NetScaler Gateway before 14.1-73.37 and before 13.1-64.23. The vulnerability was published on September 27, 2026, and carries a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Citrix Advisory).

The vulnerability is classified under CWE-342 (Predictable Exact Value from Previous Values), meaning the system's cryptographic or random value generation is insufficiently unpredictable — an attacker who observes previous values can accurately predict future ones. This flaw is exploitable remotely over the network with no authentication, no user interaction, and low attack complexity required. The weakness undermines security mechanisms that depend on cryptographic randomness, such as session tokens, nonces, or other security-critical values generated by the affected NetScaler products. No public proof-of-concept code has been identified at this time (GitHub Advisory, Citrix Advisory).

Successful exploitation allows an unauthenticated attacker to predict cryptographic values generated by the vulnerable system, potentially enabling session hijacking, authentication bypass, or circumvention of other security controls that rely on random value unpredictability. The CVSS v4.0 scoring reflects high integrity and availability impact on the vulnerable system, with low confidentiality impact, and moderate downstream impact on subsequent systems. Given that NetScaler ADC and Gateway are commonly deployed as network access and application delivery controllers, compromise could facilitate lateral movement into protected internal networks or expose sensitive application traffic (GitHub Advisory).

As of the disclosure date (September 27, 2026), there is no public proof-of-concept exploit and no confirmed evidence of active in-the-wild exploitation specific to CVE-2026-88778. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. However, CVE-2026-88778 was disclosed alongside a broader set of NetScaler vulnerabilities (CVE-2026-88771 through CVE-2026-88777), some of which have been reported as actively exploited zero-days, which may elevate the overall risk profile of this vulnerability (Citrix Advisory, The Hacker News, CISA Alert).

Citrix has released patched versions addressing CVE-2026-88778. Organizations should update to the following versions or later:

• NetScaler ADC: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279 FIPS and NDcPP
• NetScaler Gateway: 14.1-73.37 or 13.1-64.23

Administrators should prioritize patching internet-facing NetScaler instances and review any security controls in their environment that depend on cryptographic randomness generated by these products. Refer to the official Citrix security bulletin for full guidance (Citrix Advisory).

The disclosure of CVE-2026-88778 occurred alongside a cluster of eight NetScaler CVEs (CVE-2026-88771 through CVE-2026-88778), with two of the higher-severity RCE vulnerabilities in the batch reported as actively exploited zero-days, drawing significant attention from the security community. CISA issued an alert, and national CERTs including CERT-EU, NCSC Ireland, and the Canadian Centre for Cyber Security (CCCS) published advisories covering the broader NetScaler vulnerability set (CISA Alert, CERT-EU, CCCS Advisory). Security media outlets including The Hacker News, CyberSecurityNews, and Heise covered the broader NetScaler zero-day crisis, and community discussion was active on Reddit's r/Citrix and Mastodon/Infosec.exchange (The Hacker News, CyberSecurityNews).