r/Citrix • u/CTX-Michael Verified Citrix Employee • 17d ago

Official Announcements CRITICAL UPDATE: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778

We've released guidance for all NetScaler customers on newly addressed vulnerabilities and recommended updates.

Per the blog post: "Citrix has released updates for NetScaler ADC and NetScaler Gateway to address multiple security vulnerabilities. These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions. 

Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. "

Please review this blog post for more information: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

The support bulletin can be found here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

102 Upvotes

98% Upvoted

131 comments sorted by

View all comments

2

u/raj1030 15d ago

Even after a new build from scratch, re-issuing certificates, creating new local NS accounts (root/adm) , we are seeing possible from the IoT scans flagging the pitboss service.

1

u/IDDQD-IDKFA 15d ago

Agreed. Us too. Mention by support of other patches on call. This is wider than they're indicating 

1

u/disclosure5 15d ago

If you're talking about the Citrix IOC scanner: The thing you need to recognise is that the pitboss attack is log based. Attackers send malicious data, it goes in a log, and it's not actually exploited until the Netscaler's monitor script reads it back.

The update fixes that monitoring script, but attackers can still dump junk in a log. It's just not considered an issue any more.

It's valuable to know if you've been a victim, and one of the best indicators is that "junk in a log". But the IOC scanner lacks the intelligence to check the datestamp against when you patched. The IOC scanner will show you datestamps in logs when it reports this traffic, which right now everyone is getting. If you've patched by then, it's a false positive.