AX·NEWS
Sign in

Vulnerability

CVE-2026-88772 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

critical 9.5 Exploited in the wild 10 stories · 7 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Citrix NetScaler ADC < 14.1-73.37 · < 13.1-64.23
  • Citrix NetScaler Gateway < 14.1-73.37 · < 13.1-64.23

Memory corruption · over the network · no login

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CISA Known Exploited Vulnerabilities

Added on 2026-09-27, federal remediation due 2026-09-30. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
    USCloudflare Blog Cloud & Infrastructure

    The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an…

  2. September 2026 CVE Landscape
    USRecorded Future Cybersecurity

    In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these…

  3. Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
    USSecurityWeek Cybersecurity

    Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772. The post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on…

  4. Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
    INThe Hacker News Cybersecurity

    Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772…

  5. Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
    USCyberScoop Asia Cybersecurity

    Attackers remained undetected for more than three weeks as they exploited a critical zero-day vulnerability affecting Citrix NetScaler appliances en masse. The earliest known instance of CVE-2026-88772 exploitation occurred Sept. 3…

  6. Hackers exploit Citrix NetScaler zero-day to deploy web shells
    USBleepingComputer Cybersecurity

    Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]

  7. Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
    USGoogle Cloud Blog Cloud & Infrastructure

    Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler…

  8. Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings
    USCyberScoop Asia Cybersecurity

    Citrix took most of the weekend to confirm that attackers were actively exploiting the newest round of NetScaler zero-days, leaving network defenders and threat hunters to react without official confirmation. Yet, behind the scenes…

  9. Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
    USSecurityWeek Cybersecurity

    Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772. The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek .

  10. Citrix admins warned to shut down NetScalers over 2 exploited zero-days
    USBleepingComputer Cybersecurity

    Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]