CVE-2026-88772: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2026-88772 is a critical Remote Code Execution (RCE) and Denial of Service vulnerability affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. It was published on September 27, 2026, and affects NetScaler ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; and NetScaler Gateway versions before 14.1-73.37 and before 13.1-64.23. The vulnerability was exploited as a zero-day before patches were released and was added to CISA's Known Exploited Vulnerabilities catalog on the same day as disclosure. It carries a CVSS v4.0 base score of 9.5 (Critical) (GitHub Advisory, Citrix Advisory).

The vulnerability exists in Citrix NetScaler ADC and Gateway and enables unauthenticated remote attackers to execute arbitrary code or cause a denial of service condition. No CWE classification has been formally assigned, and the specific root cause (e.g., memory corruption, input validation failure) has not been publicly disclosed as of the time of reporting. The attack vector is network-based, requires no privileges or user interaction, and has no attack requirements — though attack complexity is rated High, suggesting some non-trivial exploitation condition must be met. No public proof-of-concept exploit code has been confirmed, but active in-the-wild exploitation was reported prior to patch availability (GitHub Advisory, Citrix Advisory).

Successful exploitation allows an unauthenticated network attacker to execute arbitrary code on the affected NetScaler ADC or Gateway appliance, or render it unavailable via denial of service. Given that NetScaler ADC and Gateway are commonly deployed as internet-facing load balancers, SSL VPN endpoints, and remote access gateways, a compromise could expose internal network segments, VPN credentials, session tokens, and sensitive traffic passing through the device. The subsequent system impact metrics are all rated High, indicating that downstream systems and infrastructure connected through the compromised appliance are also at significant risk (GitHub Advisory, Security Affairs).

CVE-2026-88772 was actively exploited as a zero-day in the wild prior to the release of patches, with exploitation confirmed by Citrix and reported by multiple security outlets (Security Affairs, The Hacker News). CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026 (CISA). No public proof-of-concept exploit code has been confirmed, though exploitation has been reported by Citrix and corroborated by researchers including Kevin Beaumont (GossiTheDog). The EPSS score is currently 0.0, likely reflecting the recency of the disclosure. No specific threat actor attribution has been publicly confirmed at this time.

1. Reconnaissance: Identify internet-facing Citrix NetScaler ADC or Gateway instances using tools such as Shodan, Censys, or Fofa, filtering for vulnerable versions (ADC before 14.1-73.37 or 13.1-64.23; Gateway before 14.1-73.37 or 13.1-64.23).
2. Target identification: Confirm the target is running a vulnerable version by examining HTTP response headers, login page banners, or version-specific URL patterns exposed by the NetScaler management or data plane interface.
3. Exploit delivery: Send a specially crafted network request to a vulnerable endpoint on the NetScaler appliance. The precise exploitation mechanism has not been publicly disclosed, but the high attack complexity rating suggests some form of specific request crafting or timing condition is required.
4. Code execution: If successful, the exploit achieves arbitrary code execution on the appliance as a privileged process, enabling the attacker to deploy backdoors, exfiltrate VPN session data, pivot to internal network segments, or cause a denial of service.
5. Post-exploitation: Leverage the compromised gateway to intercept VPN credentials, move laterally into the internal network, or establish persistent access via implanted web shells or modified configuration (Citrix Advisory, Security Affairs).

• Network: Anomalous or unexpected inbound requests to NetScaler management or data plane interfaces from external IP addresses; unusual outbound connections from the NetScaler appliance to unknown external hosts.
• Logs: Unexpected errors or crashes in NetScaler system logs around the time of suspected exploitation; unusual authentication events or session activity in the NetScaler Gateway access logs.
• File System: Presence of unexpected files, scripts, or web shells in NetScaler appliance directories; modifications to configuration files not initiated by administrators.
• Process: Unusual processes spawned on the NetScaler appliance, particularly those initiating outbound network connections or executing shell commands not consistent with normal appliance operation.
• Availability: Unexpected appliance reboots, crashes, or degraded performance that may indicate denial-of-service exploitation attempts (Citrix Advisory, CISA).

Citrix has released patched versions addressing CVE-2026-88772. Administrators should upgrade immediately to the following fixed versions:

• NetScaler ADC: 14.1-73.37 or later; 13.1-64.23 or later; 14.1-73.37 FIPS or later; 13.1.37.279 FIPS and NDcPP or later
• NetScaler Gateway: 14.1-73.37 or later; 13.1-64.23 or later

Given active in-the-wild exploitation, Citrix and security advisories recommended that administrators who could not immediately patch consider shutting down or isolating vulnerable NetScaler appliances. Restricting network access to the management interface and monitoring for anomalous activity are additional defensive measures. CISA's KEV listing mandates federal agencies apply patches under Binding Operational Directive 22-01 (Citrix Advisory, CISA, BleepingComputer).

Citrix confirmed the active exploitation of CVE-2026-88772 alongside a companion vulnerability (CVE-2026-88771) in its official security bulletin, urging immediate patching (Citrix Advisory). Security researcher Kevin Beaumont (GossiTheDog) flagged the exploitation activity on Mastodon, drawing early community attention before the official patch was available. CISA issued an alert and added the CVE to its KEV catalog on the same day as disclosure, reflecting the severity and confirmed exploitation (CISA). National CERTs including CERT-EU, the Irish NCSC, and the Canadian Centre for Cyber Security (CCCS) all issued advisories urging organizations to patch immediately (CERT-EU, Canadian CCCS). Coverage from BleepingComputer, The Hacker News, Security Affairs, and Heise highlighted the urgency, with BleepingComputer specifically reporting that admins were warned to shut down unpatched NetScalers (BleepingComputer).