Citrix NetScaler Vulnerabilities Added to CISA Known Exploited Vulnerabilities Catalog

What's on the official record

CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities Catalog on 27 September 2026. The vulnerability is an improper input validation vulnerability (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that could allow an unauthenticated attacker to execute arbitrary commands. CISA's remediation due date for federal civilian agencies is 30 September 2026, and the catalog version is 2026.10.21. The CVE record lists the first fixed versions as Citrix ADC 14.1-73.37 and 13.1-64.23. FIRST's EPSS model estimates a 0.047 probability of exploitation (92nd percentile, 23 October 2026). CISA's ADP SSVC assessment records exploitation as active, automatable as yes, and impact as total.

CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities Catalog on 27 September 2026. The vulnerability is an improper restriction of operations within the bounds of a memory buffer vulnerability (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that could allow for remote code execution or denial of service. CISA's remediation due date for federal civilian agencies is 30 September 2026, and the catalog version is 2026.10.21. The CVE record lists the first fixed versions as Citrix ADC 14.1-73.37 and 13.1-64.23. FIRST's EPSS model estimates a 0.053 probability of exploitation (93rd percentile, 23 October 2026). CISA's ADP SSVC assessment records exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Citrix NetScaler ADC or NetScaler Gateway instance in your estate is running a version before 14.1-73.37 or 13.1-64.23, and patch or isolate those instances to the first fixed versions the CVE record names. The catalog's 30 September 2026 remediation due date marks the federal civilian deadline, and the record's active-exploitation SSVC assessment supports treating unpatched instances as a priority to patch or pull from service.

For a cyber underwriter, the record lets you check policyholders' NetScaler ADC and NetScaler Gateway estates against the fixed versions 14.1-73.37 and 13.1-64.23, and require a control or price coverage where instances remain below those versions. The catalog records active exploitation for both vulnerabilities, which supports asking whether a policyholder has applied the vendor mitigations before binding or renewing.

What would change this call

• A Citrix advisory or CVE record update that revises the fixed versions for either CVE.
• A CISA update to the Known Exploited Vulnerabilities Catalog that changes the remediation due date or the SSVC assessment for either CVE.
• Evidence that either vulnerability is being used in ransomware campaigns, which the catalog currently does not record.

What to check next

Confidence

Filed 25 October 2026 from the record dated 27 September 2026.

The record is drawn from CISA's Known Exploited Vulnerabilities Catalog and the CVE records, both primary official sources. EPSS figures are FIRST's model estimates, not observed exploitation. SSVC assessments are attributed to CISA's ADP. The catalog does not record known ransomware use for either vulnerability.

Sources

[1] Citrix NetScaler Improper Input Validation Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-88771

[2] CVE record CVE-2026-88771 — https://www.cve.org/CVERecord?id=CVE-2026-88771

[3] Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-88772

[4] CVE record CVE-2026-88772 — https://www.cve.org/CVERecord?id=CVE-2026-88772

[5] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog