Posting Date: 2026/10/13

【Vulnerability Alert】NetScaler ADC and NetScaler Gateway Have 3 Critical Security Vulnerabilities

  • Subject:【Vulnerability Alert】NetScaler ADC and NetScaler Gateway Have 3 Critical Security Vulnerabilities


  • Description:
    • Forwarded TWCERT/CC (Taiwan Computer Emergency Response Team and Coordination Center) Security Alert TWCERTCC-200-202610-00000003
    • Citrix's NetScaler ADC (formerly Citrix ADC) is a network device designed to optimize, protect, and manage enterprise applications and cloud services; NetScaler Gateway (formerly Citrix Gateway) provides a secure remote access solution that allows users to securely access applications and data from anywhere. Recently, Citrix released a critical security vulnerability advisory (CVE-2026-88771, CVSS 4.x: 9.5, CVE-2026-88772, CVSS 4.x: 9.5, CVE-2026-88773, CVSS 4.x: 9.3). Among these, attacks exploiting CVE-2026-88771 and CVE-2026-88772 have been observed, so immediate temporary mitigation measures are recommended to prevent possible attacks against these vulnerabilities.
    • CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution (RCE) or denial of service (DoS).
    • CVE-2026-88773 is an HTTP request parsing inconsistency vulnerability.
    • CVE-2026-88771 is an improper input validation vulnerability that allows unauthenticated attackers to remotely execute arbitrary code (RCE).
  • Affected Platforms:
    • NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37 (exclusive), NetScaler ADC and NetScaler Gateway versions prior to 13.1-64.23 (exclusive), NetScaler ADC FIPS versions prior to 14.1-73.37 (exclusive), NetScaler ADC FIPS and NDcPP versions prior to 13.1-37.279 (exclusive)
  • Recommended Actions:
    • Please update to the following versions: NetScaler ADC and NetScaler Gateway versions 14.1-73.37 (inclusive) and later, NetScaler ADC and NetScaler Gateway versions 13.1-64.23 (inclusive) and later, NetScaler ADC FIPS versions 14.1-73.37 (inclusive) and later, NetScaler ADC FIPS and NDcPP versions 13.1-37.279 (inclusive) and later
  • References:
    1. https://www.twcert.org.tw/tw/cp-169-11256-646ba-1.html

Computer and Communication Center
Network System Division