Multiple Vulnerabilities in NetScaler ADC and NetScaler Gateway Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in NetScaler ADC and NetScaler Gateway, the most severe of which could allow for remote code execution. NetScaler ADC is a networking product that functions as an Application Delivery Controller (ADC), optimizing, securing, and ensuring reliable availability of applications for businesses. NetScaler Gateway is a secure remote access solution that provides users with single sign-on (SSO) access to applications and resources from any device. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution of commands on the system.

There are reports of CVE-2026-88771 and CVE-2026-88772 being actively exploited in the wild.

Multiple vulnerabilities have been discovered in NetScaler ADC and NetScaler Gateway, the most severe of which could allow for remote code execution. Details of the vulnerabilities are as follows:

Tactic:Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

We recommend the following actions be taken:

Safeguard 10.5:Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

UPDATE 10/5/2026:

Although Citrix hasn't provided information on the observed behavior, they state that "the issue is associated with NetScaler deployments that use SAML authentication in conjunction with Gateway or AAA functionality". The issue is reportedly configuration dependent, and only affects NetScaler when at least one of the following SAML commands is present:

Customers are recommended to contact Citrix support if any impacts are being experienced.

Copyright©2026 Center for Internet Security®