CVE-2026-88772 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-27

Added to CISA KEV: 2026-09-27 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE ACTION REQUIRED: This CVE is in the CISA KEV catalog with confirmed active exploitation. Assume any unpatched internet-facing NetScaler ADC or Gateway appliance may already be compromised. Begin incident response procedures in parallel with patching.
PATCH IMMEDIATELY: Upgrade all NetScaler ADC and NetScaler Gateway appliances to version 14.1-73.37 or later (13.1-64.23 or later for 13.x branch; 14.1-73.37 FIPS or 13.1.37.279 FIPS/NDcPP for FIPS-mode deployments). This is the highest-priority patch action.
INTERIM MITIGATION (if patching is delayed): Disable DTLS on all VPN virtual servers. DTLS is the vulnerable protocol component — disabling it removes the attack surface. Verify the change is applied and test VPN connectivity (users will fall back to TLS-based tunneling).
THREAT HUNT — CHECK FOR COMPROMISE: Review NetScaler access logs for anomalous DTLS traffic patterns, unexpected process execution, unusual outbound connections from appliances, or signs of configuration modification. Check for web shells or backdoors deployed post-exploitation.
NETWORK MONITORING: Deploy IDS/IPS signatures for malformed DTLS packets targeting NetScaler appliances. Monitor for unusual traffic volumes on UDP/443 from external IP addresses.
INVENTORY: Immediately identify all internet-facing NetScaler ADC and Gateway appliances in your environment, including shadow IT and branch deployments. Prioritize any appliances running versions older than the fixed releases.
PATCH PRIORITY: CRITICAL / P0 — Treat this as an emergency patch cycle. Do not wait for the next scheduled maintenance window. The combination of unauthenticated RCE, default attack surface exposure, and confirmed active exploitation places this in the highest possible urgency tier.

🔍 Web Intelligence (Kagi · 2026-09-27)

Summary

CVE-2026-88772 is a critical memory overflow vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway when Datagram Transport Layer Security (DTLS) is enabled. It is significant because it allows unauthenticated, remote attackers to achieve remote code execution (RCE) or trigger a denial-of-service (DoS) condition on vulnerable appliances ^[2]^[3]. Given that DTLS is enabled by default for VPN virtual servers, many NetScaler Gateway deployments are exposed to this vulnerability by default ^[2].

Exploitation

Active Exploitation: The vulnerability is being actively exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities (KEV) Catalog ^[1].
Threat Actors: Specific threat actors or ransomware campaigns have not been publicly identified by name, but reports confirm global exploitation is underway ^[1].
Exploit Tools: Public availability of proof-of-concept code or specific exploit tools has not been confirmed in the initial advisory, though the fact of active exploitation confirms the existence of functional exploits ^[1].
Attack Prerequisites: This is a remote, network-based attack. No authentication is required for exploitation, and no specific user interaction is needed ^[2].

Affected Products & Patches

Affected Versions: Citrix NetScaler ADC and Citrix NetScaler Gateway versions prior to 14.1-73.37 ^[4]^[5].
Patch Availability: Fixed releases (14.1-73.37 and later) are available, and vendors strongly urge all affected customers to upgrade immediately ^[4].
Mitigations: For those unable to patch immediately, disabling DTLS on affected appliances serves as an effective temporary mitigation, as the vulnerability requires DTLS to be enabled ^[2].

Impact

Successful Exploitation: Provides an attacker the ability to execute arbitrary code with the privileges of the affected service (RCE) or force the appliance to crash, resulting in a denial-of-service (DoS) ^[2].
Business Risk: Internet-facing deployments are at extreme risk. Compromise of a NetScaler ADC or Gateway often grants attackers a foothold into the internal network, potentially facilitating lateral movement, data exfiltration, or the disruption of critical remote access services for the entire organization ^[1].

Sources

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC ...
CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively…
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days ...
"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," the company said. It did not say ... CVE-2026-88772 (CVSS v4 score: 9.5) - A memory overflow that can lead to remote code execution or denial-of-service (DoS). It affects appliances with DTLS ena…
Article Record Type: Security Bulletin
CVE-2026-88772, Memory overflow vulnerability leading to Remote Code Execution or Denial of Service, DTLS configuration enabled on NetScaler ADC ...
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for ...
Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. Citrix NetScaler ADC and Citrix NetScaler…
CVE Record: CVE-2026-88772
Description. Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, ...

🔴 CVE-2026-88772