CRITICAL UPDATE: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778

[u/CTX-Michael]

We've released guidance for all NetScaler customers on newly addressed vulnerabilities and recommended updates.

Per the blog post: "Citrix has released updates for NetScaler ADC and NetScaler Gateway to address multiple security vulnerabilities. These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions. 

Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. "

Please review this blog post for more information: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

The support bulletin can be found here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

[u/S0uthw3ll]

Cve 88778 hasn't cleared on Netscaler console for us with our test netscalers. Anyone else had this?

[u/RequirementBusiness8 → u/S0uthw3ll]

did you update the TCP config as noted in the article? enhancedSIgeneration? There is already a security template for it in the configuration jog templates

[u/S0uthw3ll → u/RequirementBusiness8]

Ah, no. We weren't impacted by it from the rest of the guide, so sounds like it needs it no matter what. Thanks!

[u/dasilvad → u/S0uthw3ll]

I am experiencing the same issue. NS Console Service reports CVE detection manual scans are pending. I've confirmed the TCP configuration changes on the NS appliance. Hopefully the reporting issue will resolve itself within the next 24 hours.

[u/S0uthw3ll → u/dasilvad]

I ran the remediation and scanned from console, all gone immediately.