Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-88772
Citrix · NetScaler · Added 2026-09-27 · Published 2026-09-27
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
VendorCitrix
ProductNetScaler
Date added2026-09-27
Due date2026-09-30
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-119
Descriptions

KEV: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

NVD: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-09-27 22:20 UTC
Wall time0.6s
Searches7
Component defaultyes
Sources https://support.citrix.com/external/article/CTX697096
https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
https://securityaffairs.com/199873/security/citrix-confirmed-two-new-netscaler-flaws-exploited-as-zero-day.html
https://github.com/murrez/CVE-2026-88772
https://docs.netscaler.com/en-us/netscaler-gateway/current-release/configure-dtls-virtual-server-using-ssl-virtual-server.html
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
https://nvd.nist.gov/vuln/detail/CVE-2026-88772

QC notes

warn component_extraction: Component 'DTLS protocol handling on DTLS-enabled NetScaler ADC / NetScaler Gateway virtual servers (VPN vServer DTLS listener, typically UDP 443)' matches or contains product name 'NetScaler' — no specific component identified

Hunting hypothesis agent

Hunt UDP/443 firewall and packet-capture logs for DTLS ClientHello records (0x16 0xfe 0xfd) hitting NetScaler Gateway DTLS virtual servers, plus HTTP access-log GETs to /vpn/index.html and /logon/LogonPoint fingerprinting before crashes.

Research details

ComponentDTLS protocol handling on DTLS-enabled NetScaler ADC / NetScaler Gateway virtual servers (VPN vServer DTLS listener, typically UDP 443)
PreconditionsUnauthenticated network reachability to DTLS on the appliance (typically UDP 443) with DTLS enabled: DTLS is on by default for NetScaler Gateway VPN virtual servers unless '-dtls OFF' is set, or any vServer of type DTLS. Affects ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, ADC 14.1-FIPS before 14.1-73.37 FIPS and ADC 13.1-FIPS/NDcPP before 13.1.37.279; CVSS v4.0 AC:H, no authentication or user interaction. agent
DeliveryUnauthenticated DTLS traffic (typically UDP 443) to a DTLS-enabled NetScaler ADC or NetScaler Gateway VPN virtual server
Public PoCyes
PoC URLs https://github.com/murrez/CVE-2026-88772 Third-party repos; verify before use.
Advisoryhttps://support.citrix.com/external/article/CTX697096
Exploit notesCVSS v4.0 9.5 (AV:N/AC:H/PR:N/UI:N): unauthenticated network attack against DTLS traffic, high complexity. Citrix and CISA confirm in-the-wild exploitation, but no weaponized overflow trigger is public — the GitHub repo murrez/CVE-2026-88772 is detection-only: it fingerprints Gateway/ADC with GETs to /vpn/index.html, /logon/LogonPoint/index.html and /vpns/services.html, parses build strings, checks UDP/443 and optionally sends a benign DTLS 1.2 ClientHello probe (record bytes 16 fe fd); its exploit mode explicitly refuses to send an overflow payload. DTLS runs over UDP, so stock HTTP access logs will not capture the attack traffic — defenders need firewall/UDP flow logs, packet capture, NetScaler nsconns/core dumps and the IoC scan in NetScaler Console (advisory CTX694799 covers compromise triage).
SummaryCitrix NetScaler ADC and NetScaler Gateway are affected by a memory overflow (CWE-119, CVSS v4.0 9.5) in DTLS handling that an unauthenticated remote attacker can turn into code execution or a denial of service. The flaw only requires DTLS to be enabled, which is the default on Gateway VPN virtual servers, and Citrix and CISA confirm it has been exploited in the wild as a zero-day. Fixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP builds (CISA due date 2026-09-30); no weaponized public exploit is known.

Tia coverage

First reported2025-08-26
First exploit report2026-09-27
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

citrix-netscaler-unpatched-rce-zero-daysseptember-2026-cve-landscape

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub