Major Citrix NetScaler Vulnerabilities Found

Citrix and the Cybersecurity and Infrastructure Security Agency have released an advisory detailing vulnerabilities for versions of Citrix NetScaler ADC and NetScaler Gateway.

These vulnerabilities cover multiple areas of concern:

Your organization is only vulnerable if you are running affected configuration on an affected version.

This table summarizes affected and fixed code versions:

Affected Product Affected Versions Fixed Versions
NetScaler ADC & NetScaler Gateway 14.1 prior to 14.1-73.37 14.1-73.37 and later
NetScaler ADC & NetScaler Gateway 13.1 prior to 13.1-64.23 13.1-64.23 and later
NetScaler ADC FIPS prior to 14.1-73.37 FIPS 14.1-73.37 FIPS and later
NetScaler ADC FIPS and NDcPP prior to 13.1.37.279 13.1.37.279 and later

The following configuration elements are vulnerable:

  • CVE-2026-88772 (DTLS Configuration): "add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE"

  • CVE-2026-88773 and CVE-2026-88774: "add lb vserver", “add cs vserver”

  • Auth or VPN vserver: "add authentication vserver .*" or "add vpn vserver .*"

  • CVE-2026-88776: “add lb vserver.*ORACLE.*”

  • CVE-2026-88777: “grep -iE '' /nsconfig/ns.conf”, “add (lb|cs) vserver .* FTP”

Please keep in mind that your device is affected if you are running an affected version and use one or some of the configuration elements above.

For more information on security updates, please see Citrix’s advisory page for these vulnerabilities.

If you are interested in more information on the vulnerabilities, go to the TechZone blog.

Please patch affected systems as soon as possible! Fixed software is available via Citrix. Please also regularly audit your internet gateways, consolidating where possible, isolate web-facing applications, and harden your operating systems and applications, including regular patching.

General guidance for protecting your environment is available from the Cybersecurity and Infrastructure Security Agency website.

SecurityLARG*net