CVE-2026-88771

CVE-2026-88771. NVD scores it 9.8 Critical (CVSS 3.1). Citrix scores it 9.5 Critical on the CVSS 4.0 scale (0 to 10). Citrix describes it as "a remote code execution vulnerability" due to improper input validation "which can allow an unauthenticated attacker to execute arbitrary commands." Citrix's precondition: "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)." On CISA KEV since September 27, 2026.

CVE-2026-88772. NVD scores it 8.1 High (CVSS 3.1). Citrix scores it 9.5 Critical (CVSS 4.0). Citrix describes it as a "memory overflow vulnerability leading to Remote Code Execution or Denial of Service." Citrix's precondition: "DTLS configuration enabled on NetScaler ADC or NetScaler Gateway (Note: Enabled by default on VPN vServer)." That default makes Gateway appliances the first priority. On CISA KEV since September 27, 2026.

CVE-2026-88773. NVD scores it 10.0 Critical (CVSS 3.1). Citrix scores it 9.3 Critical (CVSS 4.0). Citrix describes it as HTTP request smuggling (CWE-444) with the precondition "HTTP Configuration enabled on NetScaler ADC or NetScaler Gateway," and lists Load Balancing, Content Switching, VPN or Authentication virtual servers of type HTTP or SSL as the configurations to check. Citrix's blog says it "has been discovered internally." Not on KEV.

The proof of concept, published October 31, 2026 at github.com/Fyyre/CVE-2026-88773, says "the only precondition is reachability of an HTTP virtual server on the appliance" and that "No authentication is required." According to the Fyyre and Scyrix LLC repositories, the packet engine's chunked-body parser reads the chunk-size field into a 32-bit value with no overflow check, so a size of 100000005 wraps to 5; NetScaler forwards the original framing but ends the request at the wrapped size. The repositories say a backend that also truncates to 32 bits runs the leftover bytes as a second request, while a backend that parses correctly hangs waiting for about 4 GB of body. The Fyyre README states: "This is a research proof-of-concept. It does not include weaponization (sorry!)". Fyyre credits the detailed research to Scyrix LLC.

The other five CVEs in the advisory. CVE-2026-88774 through CVE-2026-88778 are fixed in the same builds. For CVE-2026-88778 (TCP initial sequence number prediction), Citrix also says "NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change" (Enhanced ISN Generation). Its check is show ns tcpparam | grep "Enhanced ISN Generation"; a result of "Enhanced ISN Generation: DISABLED" on an appliance with a TCP-based virtual server means the precondition is met.

Scope. Citrix says Secure Private Access Hybrid deployments using NetScaler instances "are also affected." Citrix-managed cloud services, including Gateway Service and Citrix-managed Adaptive Authentication, are upgraded by Citrix. Citrix's blog says the NetScaler VPX 15.1 Technology Preview firmware is also vulnerable, with a fix to follow; Citrix does not permit that firmware in production.

Before you upgrade 13.1. Citrix's blog says 13.1-64.23 has a known issue where some configurations go into a cyclic reboot during the upgrade, and gives a command to check; if the command lists configured variables, Citrix says to plan for 13.1-64.24 instead. The blog also says NetScaler Console's CVE scan may incorrectly flag appliances on 13.1-64.23 as vulnerable until its next Security Advisory update.

Credit. Citrix's bulletin acknowledges Michael Tucker and Chew Keong Tan of the JPMorgan Chase XOR Team, and Maxim Suhanov. It does not say which CVE each reported.

Not to be confused with. The CitrixBleed-family NetScaler memory disclosure bugs on KEV, CVE-2023-4966 and CVE-2025-5777, are separate flaws with separate fixes.

The test. Is the build below Citrix's fixed release? On each appliance run show ns version and compare it to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 for FIPS and NDcPP. If it is below, the appliance is exposed to CVE-2026-88771, which Citrix says needs nothing beyond the default configuration. If it is at or above, all three are closed. The checks below don't change that answer. They only rank which unpatched appliances to upgrade first.

1. Gateway appliances (CVE-2026-88772). DTLS is on by default on VPN virtual servers. Citrix gives these patterns: add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE "indicates DTLS is not explicitly disabled, so DTLS is enabled by default"; add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF -Listenpolicy NONE "indicates DTLS is explicitly disabled, so the precondition is not met"; and virtual servers of type DTLS, such as add vpn vserver vs1 DTLS 10.11.1.1 443 or add lb vserver vd_dtls DTLS ..., indicate DTLS is enabled. Check /nsconfig/ns.conf.
2. Internet-facing virtual servers. Appliances whose Gateway or load-balanced VIPs answer from the internet come next. None of the three CVEs needs authentication.
3. HTTP configuration (CVE-2026-88773). Run show lb vserver, show cs vserver, show vpn vserver and show authentication vserver and look for type HTTP or SSL, per Citrix's precondition check.

Citrix gives no temporary mitigation for CVE-2026-88771, CVE-2026-88772 or CVE-2026-88773; its remedy is the upgrade. Each line below works only under the condition at the end of it.

• Delivery. Restrict who can reach Gateway and load-balanced virtual servers that don't need to be public, using upstream firewall rules or NetScaler ACLs, only if those services genuinely have no external users.
• Delivery. Set -dtls OFF on VPN virtual servers, which Citrix says means the CVE-2026-88772 precondition is not met, only if your users can work without DTLS and you accept it does nothing for CVE-2026-88771.

Upgrading to Citrix's fixed NetScaler build is the only fix.

Citrix has not published network indicators in its bulletin. Its blog says it is making generic Indicators of Compromise available through the NetScaler Console Security Advisory page (version 14.1-73.36 or later, with the telemetry channel enabled), and that customers without NetScaler Console should contact Citrix Support for them. Citrix also points to NetScaler Console File Integrity Monitoring for unexpected file changes, and recommends forwarding NetScaler logs to an external logging or SIEM platform. Citrix cautions that the IoC information "might be of limited forensic value and might fail to identify actual compromises."

Am I exposed to CVE-2026-88771, CVE-2026-88772 or CVE-2026-88773?

Yes, if a customer-managed NetScaler ADC or Gateway runs a build below 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 for FIPS and NDcPP. CVE-2026-88771 needs nothing beyond the default configuration.

Is CVE-2026-88771 being exploited?

Yes. Citrix says exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments have been observed, and CISA added both to KEV on September 27, 2026, with action due September 30, 2026.

Is there a patch for CVE-2026-88773?

Yes. Citrix fixed it on September 27, 2026 in CTX697096, in the same builds that fix CVE-2026-88771 and CVE-2026-88772.

How do I mitigate CVE-2026-88771 without patching?

Citrix gives no workaround. Limiting who can reach the appliance reduces exposure, and disabling DTLS removes the CVE-2026-88772 precondition, but neither fixes CVE-2026-88771.

I patched late. How do I know if I was compromised?

Citrix's blog for this advisory says it is making generic Indicators of Compromise available through NetScaler Console (Security Advisory page, version 14.1-73.36 or later, telemetry channel enabled), and that customers without NetScaler Console should contact Citrix Support for the IoCs or for help running the scan. Citrix also points to NetScaler Console File Integrity Monitoring. Citrix cautions that the IoC information "might be of limited forensic value and might fail to identify actual compromises" and advises retaining experienced forensic investigators. Citrix states that applying the update "does not remove potential compromise artifacts or prove that exploitation did not occur before the update," and recommends deploying a new, updated NetScaler instance if compromise is suspected or confirmed.

Nov 2, 2026. First published. CVE-2026-88771 and CVE-2026-88772 on CISA KEV since Sept 27; public proof of concept for CVE-2026-88773 since Oct 31.

• Citrix security bulletin CTX697096 (Sept 27, 2026)
• NetScaler Cyber Threat Intelligence blog for the bulletin (Sept 27, updated Sept 30, 2026)
• NIST NVD: CVE-2026-88771, CVE-2026-88772 and CVE-2026-88773 (checked Nov 2)
• CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.30, checked Nov 2)
• Public code: Fyyre and Scyrix LLC (read only, not run)