Between 9 September and 4 October 2026, CISA added four Citrix NetScaler ADC and NetScaler Gateway vulnerabilities to its Known Exploited Vulnerabilities catalog across three separate updates. The most serious pair, CVE-2026-88771 and CVE-2026-88772, went in on 27 September with a federal due date of 30 September. Citrix says exploits of both have been observed on unmitigated deployments.
If you patched in early September and stopped there, you are still exposed. Each bulletin raised the minimum safe build.
What's affected
The four KEV entries:
| CVE | KEV added | Due | What it is | Precondition |
|---|---|---|---|---|
| CVE-2026-19490 | 9 Sep | 12 Sep | Authentication bypass, CVSS 4.0 score 9.3 | Gateway or AAA virtual server, SAML action on newer builds |
| CVE-2026-88771 | 27 Sep | 30 Sep | Unauthenticated command execution, 9.5 | Every deployment, default config |
| CVE-2026-88772 | 27 Sep | 30 Sep | Memory overflow, RCE or DoS, 9.5 | DTLS enabled, on by default for VPN vServers |
| CVE-2026-88779 | 4 Oct | 7 Oct | Memory overflow, DoS, 8.7 | Configured as SAML SP or SAML IdP |
CVE-2026-88771 and CVE-2026-88772 come from bulletin CTX697096, which also covers six more CVEs (88773 to 88778), including HTTP request smuggling and TCP sequence number prediction. Those six are not in KEV, but the same upgrade fixes them, except CVE-2026-88778, which also needs a TCP setting change.
Fixed builds, by bulletin:
| Line | CTX696939 (19490) | CTX697096 (88771, 88772) | CTX697174 (88779) |
|---|---|---|---|
| 14.1 | 14.1-73.32 | 14.1-73.37 | 14.1-73.41 |
| 13.1 | 13.1-63.21 | 13.1-64.23 | 13.1-64.28 |
| 14.1 FIPS | 14.1-73.32 FIPS | 14.1-73.37 FIPS | 14.1-73.41 FIPS |
| 13.1 FIPS and NDcPP | 13.1-37.277 | 13.1-37.279 | 13.1-37.282 |
The right-hand column is the one to target. 14.1-73.41 or 13.1-64.28 and later cover all four KEV entries. Secure Private Access hybrid deployments that use NetScaler instances are affected too. Citrix-managed cloud services are updated by Citrix.
How to check if you're exposed
From the NetScaler CLI, get the build:
show ns version
Then check the preconditions against your saved config, using the patterns from Citrix's bulletins. From the shell:
# CVE-2026-88772: VPN vservers without "-dtls OFF" have DTLS on by default
grep -E '^add vpn vserver' /nsconfig/ns.conf | grep -v -- '-dtls OFF'
grep -E '^add (vpn|lb) vserver .* DTLS ' /nsconfig/ns.conf
# CVE-2026-19490 and CVE-2026-88779: Gateway, AAA and SAML config
grep -E '^add (vpn|authentication) vserver' /nsconfig/ns.conf
grep -E '^add authentication (samlAction|samlIdPProfile)' /nsconfig/ns.conf
For CVE-2026-88778, Citrix's check runs from the CLI and flags appliances where Enhanced ISN Generation is disabled:
show ns tcpparam | grep "Enhanced ISN Generation"
CVE-2026-88771 has no precondition. Citrix says every NetScaler ADC and Gateway deployment is affected, including the default configuration. So the build number alone decides exposure for the most serious bug.
For hunting, CISA's KEV notes say running the IOCs Citrix provides in the NetScaler console may help identify exploitation, and they direct customers to conduct forensic triage. Citrix's indicators are published in its community blog for the 88771 to 88778 bulletin.
What to do now
- Upgrade to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282 or later. That clears all four KEV entries in one change.
- Apply the Enhanced ISN Generation setting from Citrix's TCP configuration docs if
show ns tcpparamreports it disabled. - Run Citrix's IOC checks on every appliance that was internet facing before you patched. Patching does not remove an implant.
- If anything looks wrong, follow Citrix's CTX694799 steps. For a VPX, snapshot it and document system time and NTP settings. Generate a support bundle and a Packet Engine core dump, then isolate the device.
- After a suspected compromise, rotate everything the appliance stored. Citrix lists LDAP service accounts, RADIUS shared secrets, OAuth tokens, API keys and SNMP community names. Revoke the appliance's certificates and private keys, and change passwords for users who authenticated through it.
- Rebuild rather than clean. Citrix recommends replacing and restoring VPX instances and reimaging MPX appliances, then upgrading firmware before restoring a backup that predates the compromise.
Why it matters
Edge appliances keep showing up in KEV because they sit on the internet, terminate authentication and hold credentials for the network behind them. Four NetScaler entries in under a month is not unusual for this product class. It does mean a monthly patch cycle is too slow for it.
The table above is the practical lesson. Each bulletin's "fixed" build was superseded within weeks. Track the latest fixed build per product line, not per CVE, and re-check after every new bulletin.
Try it yourself
Pull show ns version from every NetScaler you run, including lab and DR units, and compare each against 14.1-73.41 or 13.1-64.28. Then search each saved config for add vpn vserver lines without -dtls OFF. That gives you an exposure list in a few minutes.
This demo shows how continuous monitoring flags a newly exploited CVE against assets you already track:
Click through it at your own pace, or open it full screen.
Quick check
Does disabling DTLS protect against CVE-2026-88771?
No. DTLS is the precondition for CVE-2026-88772. Citrix says CVE-2026-88771 affects all deployments with the default configuration, so only the upgrade fixes it.
I upgraded to 14.1-73.37 after the 27 September bulletin. Am I covered?
Not for CVE-2026-88779. Its bulletin lists 14.1-73.41 as the first fixed 14.1 build.
Do I need to do anything for Citrix-managed cloud services?
Citrix says it upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself. The bulletins apply to customer-managed appliances.
Sources
- Citrix CTX697096: Security Bulletin for CVE-2026-88771 through CVE-2026-88778
- Citrix CTX697174: Security Bulletin for CVE-2026-88779
- Citrix CTX696939: Security Bulletin for CVE-2026-19489 and CVE-2026-19490
- Citrix CTX694799: Steps to take if NetScaler ADC is suspected to be compromised
- Citrix community blog: bulletin for CVE-2026-88771 through CVE-2026-88778
- CISA Known Exploited Vulnerabilities Catalog
