Citrix NetScaler ADC and Gateway Remote Code Execution (RCE) and DoS Vulnerability (CVE-2026-88772)

• Firmware Upgrade: Immediately apply the latest security updates from the Citrix Support portal:
• NetScaler ADC/Gateway 14.1-73.37 or later
• NetScaler ADC/Gateway 13.1-64.23 or later

• Restrict Management Access: Ensure the Management IP (NSIP) is not exposed to the public internet. Use ACLs to restrict access to trusted administrative subnets.

# Example: Restricting Management Access via CLI
add ns acl restrict_mgmt ALLOW -srcIP 10.0.0.0-10.0.0.255 -destPort 80 443
apply ns acls

• Monitor for Exploitation: Check for unusual core dumps or unexpected reboots. Review /var/log/ns.log for suspicious activity patterns.

CVE-2026-88772 is a critical memory corruption vulnerability (CWE-119) residing in the memory handling logic of Citrix NetScaler appliances. By sending specially crafted network traffic, an attacker can cause memory corruption, leading to arbitrary code execution with elevated privileges or a complete system crash (DoS). With an EPSS score of 0.94 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this flaw is a high-priority target for threat actors. Although the Attack Complexity is rated as High (AC:H), the potential impact on Confidentiality, Integrity, and Availability is total, making it a primary vector for initial access into corporate networks.