CVE-2026-88772
Critical memory-overflow flaw in DTLS-enabled NetScaler ADC and Gateway appliances.
Citrix disclosed CVE-2026-88772 on 27 September 2026 as already exploited, then replaced its first fixed builds on 4 October after a third NetScaler flaw surfaced in attacks.
Last refreshed: 12 October 2026
Which NetScaler setting exposed appliances to CVE-2026-88772?
Timeline for CVE-2026-88772
Mentioned in: Citrix replaces its own NetScaler fix
Cybersecurity: Threats and DefencesBackground
CVE-2026-88772 is a memory overflow in Citrix's NetScaler ADC and NetScaler Gateway appliances that can give an attacker Remote Code Execution or crash the device. Citrix bulletin CTX697096 rates it 9.5 under CVSS 4.0.
Exposure depends on DTLS, which Citrix says is on by default for VPN virtual servers, so most remote-access deployments qualified without their owners changing anything. Citrix published the flaw on 27 September 2026 together with CVE-2026-88771. CISA listed both as exploited the same day and gave federal agencies until 30 September. The first fixed builds, 14.1-73.37 and 13.1-64.23, were superseded on 4 October by 14.1-73.41 and 13.1-64.28.
For NetScaler owners, patching did not undo a compromise. Rapid7 found that attackers had copied appliance settings files containing directory credentials and private keys, secrets that remain usable until rotated.