UPDATED: Multiple vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway products

(Updated on 14-10-2026) A further vulnerability (CVE-2026-107406, CVSS:9.5) has been discovered impacting the same systems. CVE-2026-107406 is a memory overflow vulnerability leading to Remote Code Execution or Denial of Service. Patches for the previous vulnerabilities are still vulnerable to CVE-2026-107406. Organisations that have patched per the original vendor advisory should check the new vendor advisory to see if they are still impacted. Patching is not sufficient to remediate compromised systems.

The NCSC is aware of multiple vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. This impacts NetScaler systems configured for SAML SP or SAMP IdP. At least two of the identified vulnerabilities are under active exploitation.

CVE-2026-88771 (CVSS: 9.5): Unauthenticated remote code execution via improper input validation.
CVE-2026-88772 (CVSS: 9.5): Memory overflow vulnerability enabling remote code execution or denial of service.
CVE-2026-88773 (CVSS: 9.3): HTTP request smuggling vulnerability.
CVE-2026-88774 (CVSS: 7.0): Feature policy bypass vulnerability.
CVE-2026-88775, CVE-2026-88776, CVE-2026-88777 (CVSS: 8.8): Memory overflow vulnerability causing denial of service.
CVE-2026-88778 (CVSS: 8.8): TCP sequence number prediction vulnerability.

Citrix have provided additional patching advice for selected vulnerabilities and steps for users to determine if they are running a vulnerable instance in their advisories.

The NCSC encourages organisations in New Zealand that use the affected products to review original vendor advisory and the new vendor advisory, applying the remediation as soon as possible. We also urge affected organisations to investigate unauthorised access or compromise of the affected products.

What's happening

Systems affected

The following supported versions of customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities.

For the following versions, applicable only when configured as a SAML IdP:

NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions, applicable only when configured as a SAML SP or SAML IdP:

NetScaler ADC and NetScaler Gateway before 14.1-73.37
NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
NetScaler ADC and NetScaler Gateway before 13.1-64.23
NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1-37.279

What this means

Successful exploitation of the identified vulnerabilities could allow an attacker to achieve outcomes ranging from denial of service and security control bypass through to remote code execution. Citrix has reported that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed in the wild. Organisations using the listed Citrix products should verify their versions and refer to the vendor advisories for further guidance.

What to look for

How to tell if you're at risk

If you are running a Citrix NetScaler within the version range listed above.

How to tell if you're affected

Refer to the ‘Steps to determine if an appliance meets the CVE preconditions’ section in the original vendor advisory and the new vendor advisory.

What to do

Prevention

To prevent exploitation, the affected Citrix products need to be upgraded to the latest versions per the vendor advisory alongside any custom configurations listed in the advisory for selected CVEs.

Upgrading is not sufficient to remediate compromised systems.

More information

Read more about this alert on the vendor website:

Original CITRIX advisory External Link and new CITRIX advisor External Link y

If you require more information or further support, submit a report on our website:

Report an incident External Link External Link