CVE-2026-88771 and CVE-2026-88772 explained: what the Citrix NetScaler flaws mean for your business

The two-minute check

1. Open the NetScaler management console and look for the build number, usually on the dashboard or under System.
2. If you run NetScaler ADC, check whether your build is earlier than 14.1-73.37 or earlier than 13.1-64.23.
3. If you run a FIPS build, check whether it's earlier than 14.1-73.37 FIPS, or earlier than 13.1.37.279 FIPS and NDcPP.
4. If you run NetScaler Gateway separately, check for builds earlier than 14.1-73.37 or 13.1-64.23.
5. If someone else manages this box, ask them for the build number today. Don't wait for a scheduled check-in.

Those version lines come straight from the vendor record for both flaws (NVD, CVE-2026-88771; NVD, CVE-2026-88772). A build at or above those numbers already carries the fix.

When you can stop reading

If your business doesn't run Citrix NetScaler ADC or Citrix NetScaler Gateway anywhere, none of this applies to you. Close the tab. If you're not sure whether you run it, that uncertainty is itself worth five minutes with your IT team.

What the official record says

CVE-2026-88771 is an improper input validation flaw: the software doesn't properly check the data it receives, which lets an attacker slip in commands it should have rejected. Citrix rates it 9.5 out of 10, Critical, on version 4.0 of the Common Vulnerability Scoring System (CVSS), and the National Vulnerability Database scores it 9.8 on CVSS 3.1 (NVD; Citrix bulletin CTX697096). An attacker only needs network access. No login is required, and nobody on your team has to click anything.

CVE-2026-88772 is a memory-handling flaw in the same products. A successful attack leads to remote code execution, where the attacker runs their own code on the device, or simply crashes the appliance. Citrix also rates it 9.5 Critical on CVSS 4.0, while NVD scores it 8.1 High on CVSS 3.1 because the attack is harder to pull off: it needs specific conditions in place rather than a single request (NVD). Harder is not safe. It sits on the same exploited list as its sibling.

Both flaws are on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-09-27 with a federal due date of 2026-09-30 (CISA, CVE-2026-88771; CISA, CVE-2026-88772). A KEV listing means confirmed use in real attacks, not a theoretical risk. CISA's entries also point to indicators of compromise Citrix has published that you can run from the NetScaler console.

What that means for a business like yours

NetScaler devices are usually placed where the internet can reach them, because that's their job: they hand off remote access to your applications. A flaw that needs no login and no user click, sitting on a device exposed to the internet, is about as reachable as a bug gets. If someone gets in through either one, they land with the ability to run commands on the front door of your network, not just view a screen.

If someone else manages your IT

Send this, or something close to it:

• "Do we run Citrix NetScaler ADC or Gateway anywhere in our network?"
• "If so, please tell me the exact build number today."
• "Are we on a build that includes the fix for CVE-2026-88771 and CVE-2026-88772? If not, when is the upgrade scheduled?"
• "Please confirm the management interface isn't reachable from the open internet."
• "Have you run the Citrix indicators of compromise against our appliance?"

If you don't have that relationship yet, a free IT assessment is a fast way to find out what's exposed.

If you manage it yourself

1. Log into the NetScaler management console.
2. Find the build number under System or About.
3. Compare it against the affected builds listed above.
4. If your build is affected, upgrade to a fixed build following the Citrix bulletin. Plan a maintenance window, since the appliance restarts.
5. Restrict the management interface to specific trusted IP addresses only.
6. Turn on multi-factor authentication (MFA) for every admin account, if it isn't already on.
7. Run the indicators of compromise Citrix published, and review admin logins and commands you don't recognize.

Restricting admin access ties directly into privileged access management: fewer people, fewer paths in, less to watch.

The honest answer is now. Both flaws are already being exploited, and both are on the CISA KEV catalog with a federal deadline of 2026-09-30 (CISA). Your business isn't a federal agency, but the timing pressure is the same: attackers don't wait for your renewal cycle.

Log back into the console after the upgrade and confirm the build number is 14.1-73.37 or later on the 14.1 branch, 13.1-64.23 or later on 13.1, or the matching FIPS and NDcPP builds named in the Citrix bulletin. Confirm the appliance restarted, since some updates only take effect after a reboot. Then confirm the management interface only accepts connections from your approved IP addresses, and that MFA is required, not just available, for every admin login.

If a maintenance window is days away, these steps buy time. None of them fix the flaws.

• Restrict management access to trusted IP addresses. This narrows who can even attempt to reach the device, but it doesn't stop someone already inside your network.
• Require multi-factor authentication (MFA) on every admin account. This slows down credential theft, but it does nothing against an unauthenticated flaw like these.
• Increase log review on the device, or ask your cybersecurity provider to watch it closely. This helps you catch trouble early, but it's detection, not prevention.
• If the device sits in a regulated environment, revisit your obligations under rules like the FTC Safeguards Rule. Compliance pressure doesn't reduce risk by itself, but it does shape how fast you need to act.

Are CVE-2026-88771 and CVE-2026-88772 the same bug?

No. They're two separate flaws in the same Citrix NetScaler builds. The first is an input validation problem that lets an attacker run commands without logging in; the second is a memory-handling problem that can lead to code execution or a crash. Citrix covers both in one bulletin and one update fixes both, so you'll install one upgrade, not two.

Do I have to do anything if we only use this at home?

If you personally run Citrix NetScaler ADC or Gateway for a home setup, the same check applies. The flaws don't care whether the device sits in a server room or a closet.

Will the upgrade break anything?

Upgrading a NetScaler build means a restart, so schedule a maintenance window and watch for connection issues afterward. The interim mitigations in this guide, like IP restrictions and MFA, are configuration changes, not upgrades, and shouldn't disrupt normal use.

How do we know if we've already been hit?

Citrix has published indicators of compromise that can be run from the NetScaler console, and CISA's catalog entries point to them. Review access logs on the device for unfamiliar admin logins or commands you didn't run, and involve your IT provider if anything looks off.

Is this the same as a ransomware attack?

CISA lists known ransomware campaign use as unknown for both flaws. That doesn't rule it out later; it just means there's no confirmed case in the catalog yet.

Does this affect our compliance obligations?

If your NetScaler handles remote access to systems covered by HIPAA or the FTC Safeguards Rule, this exposure is worth documenting in your risk assessment now, along with the date you patched.

What if we don't know whether we run NetScaler at all?

That's common in growing businesses where infrastructure changes hands over time. A quick conversation with our team can confirm what's running on your network and whether it needs attention now.

LayerLogix brings 20+ years of experience and 100% Texas-based support to businesses across The Woodlands, Round Rock, Greater Houston, DFW, and Austin. If you want a straight answer on whether this touches your business, start with a free IT assessment.