watchTowr: CVE-2026-88771 Citrix NetScaler ADC/Gateway unauthenticated RCE

What it is

CVE-2026-88771 and CVE-2026-88772 affect Citrix NetScaler ADC and NetScaler Gateway, fixed in Citrix bulletin CTX697096 (published September 27, 2026). Both carry a CVSS 4.0 score of 9.5 (Critical).

Preconditions / Affected

CVE-2026-88771 affects every NetScaler ADC/Gateway deployment on an affected version by default, no special config required. CVE-2026-88772 requires DTLS enabled on a VPN virtual server — which is the default for NetScaler Gateway, so most Gateway deployments are exposed unless DTLS was explicitly disabled. Secure Private Access hybrid deployments using NetScaler instances are also affected. Appliances already patched for the earlier CVE-2026-19490 are still vulnerable unless running one of the new fixed builds. Only customer-managed appliances are affected; Citrix's own cloud-managed services are already updated.

What to do

1. Capture forensic evidence (logs, snapshot, support bundle, core dump) from each exposed appliance before updating — patching can destroy evidence of prior compromise.
2. Check for compromise using the IOC scan on the NetScaler Console Security Advisory page (requires console version 14.1-73.36+ with telemetry enabled), or request IOCs from Citrix Support. Citrix states the IOCs don't cover every exploitation technique, so a clean scan isn't proof of non-compromise.
3. Install the fixed build for your branch. On 13.1, run show ns variable first — if it returns any variables, use build 13.1-64.24 specifically to avoid a known reboot loop during upgrade.
4. Enable Enhanced ISN Generation — this is a separate configuration step required to close CVE-2026-88778 (one of the six other CVEs in the same bulletin); the build upgrade alone does not fix it.
5. Rotate passwords, secrets, and certificates stored on or accessible via the appliance, and forward NetScaler logs to your SIEM.
6. Keep management interfaces off the public internet.

flowchart TD
    A[Exposed NetScaler appliance] --> B{Capture evidence first?}
    B -->|No - patch immediately| C[Forensic evidence destroyed]
    B -->|Yes| D[Logs, snapshot, support bundle, core dump]
    D --> E[Run IOC scan / request IOCs from Citrix]
    E --> F[Install fixed build per branch]
    F --> G{On 13.1?}
    G -->|show ns variable returns values| H[Use build 13.1-64.24]
    G -->|No| I[Standard fixed build]
    F --> J[Enable Enhanced ISN Generation for CVE-2026-88778]

Caveats

Citrix has not published a workaround for either CVE — upgrading is the only fix. The IOC scan is explicitly stated by Citrix to be incomplete; a clean result doesn't rule out compromise. Only CVE-2026-88771 is confirmed in CISA's KEV catalog as exploited in the wild; the page states CVE-2026-88772 is exploitable but doesn't cite the same KEV confirmation for it specifically.