Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

Update October 9, 2026 : CISA has updated this Alert to: 1 include CVE-2026-107406; 2 include CVE-2026-88779 following its addition to the KEV Catalog on Oct. 4, 2026; 3 clarify the potential relationship between CVE-2026-88779 and CVE-2026-88771; and 4 emphasize the importance of promptly applyi...

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406

Severity - Critical Description of Problem A vulnerability has been discovered in Citrix NetScaler ADC formerly Citrix ADC and Citrix NetScaler Gateway formerly Citrix Gateway. Refer below for further details. Affected Versions: The following supported versions of Citrix NetScaler ADC and Citrix...

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779 , carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow...

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779

Severity - High Description of Problem A vulnerability has been discovered in Citrix NetScaler ADC formerly Citrix ADC and Citrix NetScaler Gateway formerly Citrix Gateway. Refer below for further details. Affected Versions: The following supported versions of NetScaler are affected by the...

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler ADC formerly Citrix ADC and Citrix NetScaler Gateway formerly Citrix Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service...

VulnCheck KEV: CVE-2026-88779

Citrix NetScaler ADC formerly Citrix ADC and Citrix NetScaler Gateway formerly Citrix Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service...

Vulnerabilities in NetScaler ADC and NetScaler Gateway

Citrix has identified 8 vulnerabilities in NetScaler ADC and NetScaler Gateway. The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are vulnerable: - Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 before version 14.1-73.37 - Citrix NetScaler ADC and Citri...

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerabilities are listed below - CVE-2026-88771 CVSS score: 9.5 - ...

Exploit for CVE-2026-88772

CVE-2026-88772 — Citrix NetScaler DTLS memory overflow Python...

CVE-2026-88778

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23...

CVE-2026-88773

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIP...

CVE-2026-88774

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-88777

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable...

CVE-2026-88771

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated...

CVE-2026-88772

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service...

CVE-2026-88775

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability...

CVE-2026-88776

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable...

EUVD-2026-87973

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23...

CVE-2026-88778 TCP Initial Sequence Number (ISN) prediction

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23...

CVE-2026-88778 TCP Initial Sequence Number (ISN) prediction

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23...