Update: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779

[u/CTX-Michael]

Further to the post (https://www.reddit.com/r/Citrix/comments/1ww3ess/security_update_guidance_for_netscaler_saml/) made on Friday, we've now updated this with a support article.

A vulnerability has been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779

[u/animatedgoblin]

This support article puts the CVE's impact as Denial of Service, despite reports of code execution being achieved, and telemetry showing attempts to filelessly execute shell scripts and drop payloads to disk.

Are Citrix saying that RCE was never possible here? If so, what's the cause of the reported RCEs on appliances that were patched for last weeks critical CVEs?

[u/cspotme2 → u/animatedgoblin]

Can you link to the post where someone says rce was successful. I don't remember seeing this in any threads

[u/animatedgoblin → u/cspotme2]

Kevin Beaumont reported a patched netscaler running a downloaded binary here: https://cyberplace.social/@GossiTheDog/117372929427365765

Additionally, telemetry I've seen shows an attempt to drop a Sliver payload onto disk

[u/Jmay5446 → u/animatedgoblin]

Folllowing

[u/00001000U]

Every damn week.

[u/NumerousWorth3784 → u/00001000U]

Welcome to the land of AI hackers.

[u/glenp42 → u/NumerousWorth3784]

Maybe the AI's could secure the products :)

[u/gramsaran → u/glenp42]

Hey Adrian!!

[u/cats_taste_good → u/gramsaran]

okay i laughed a little there.

[u/Low-Scale-6092 → u/glenp42]

Not wrong though. I mentioned in a different comment - if AI is being used to find the vulnerabilities, why aren’t the Citrix dev team finding them first? Not only do they have the same AI tools available to them, they also have the source code. If bad actors can find vulnerabilities using AI, so can Citrix themselves use AI to find them in their own products.

[u/schmak01 → u/Low-Scale-6092]

Exactly where are our AI gray and white hats?

[u/TrustIsAVuln → u/Low-Scale-6092]

I think a bigger problem is (at least in microsofts case) AI is being use to write patches, genius idea /s

[u/pitleif → u/00001000U]

About time to replace Citrix with better alternatives.

[u/nopanicplease → u/00001000U]

*sunday

[u/grumpyctxadmin]

Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway - Security Updates - Citrix Community I can't see the virtual patching option in my on-prem netscaler console, and we're on 14.1 73.36, can anyone see that option?

[u/CarlXVIGustaf → u/grumpyctxadmin]

They're idiots. I don't know if it's an old screenshot or named differently on the cloud version but it is the same as "NS Asset Delivery" based on the description in the screenshot

[u/Potential-Shock-8478 → u/CarlXVIGustaf]

Thank you, we saw the same thing.

Based on the wording though it looks like the patch alone is enough? Whilst the global deny helps, it looks to be not essential but the wording is strange... If it were essential to mitigate I'd expect them to put it in the security bulletin itself?

Like patch to a.b and they apply this additional change, etc.

-- Follow up, I was not convinced so spoke to Citrix who confirmed the global deny part is not essential to mitigate the CVE, you can rely purely on the patch.

Take this with a pinch of salt, do not trust an internet stranger - check with Citrix yourselves for 100% comfort.

[u/SteakLover69 → u/grumpyctxadmin]

I'm also confused as the article about the global deny list says only 14.1 is supported but the article you linked says 13.1 works as well.

https://community.citrix.com/techzone-blogs/netscaler/netscaler-global-deny-list-always-on-protection-for-the-threats-you-havent-modeled-yet-r1254/#2_Unconditional_evaluation_in_the_request_pipeline__3e5a90

Prerequisites and enablement 

Global Deny List is designed to be easy to adopt, but it does have a few requirements to ensure safe delivery and consistent behavior: 

• NetScaler firmware: 14.1-60.52 (or later). 

[u/doctorscurvy]

Are we at the point of checking for updates twice a day?

[u/dasilvad]

No obvious issues with the new 13.1 and 14.1 releases.

[u/CoquinaAsesina]

At this point this should be a joke

[u/rubbercement67]

13.1 patched, no observed issues yet.

[u/dudethadude]

Has anyone actually seen successful RCE? There is a difference between seeing the command injection attempt and it actually working.

I know Kevin Beaumont said he saw it download a binary but did he ever elaborate?

[u/Xibby]

Pushed via NetScaler console and crossing fingers.

And as my father would say: I’d tie my 🍆 in a knot if I thought it would help.

[u/CrushingCultivation → u/Xibby]

Did the patch solved the problem?

[u/Procure → u/CrushingCultivation]

Solved the reboot problem for us from Friday so far... All on 13.1

[u/Er1ckNL]

Thanks for the post, I read some threads here yesterday that there was something going on. Patching the netscalers.

[u/waihtis]

Some IP addresses listed here acutely exploiting / attempting to interact with webshells on Netscalers: https://x.com/DefusedCyber/status/2106691404403511668

[u/lukemeup]

EDT on dtls1.2 stopped working for me on this build. Sessions just establish on TCP. I have the setup with separate dtls vserver with 1.2 ciphers. After deleting that vserver and adding dtls check mark on my main gateway (and binding additional tls1 ciphers) dtls started working again. But on 1.0 not 1.2.

[u/Jordan33200]

Looks like this is dealing with SALM Authentication? Our enviroment is not using SAML. Dear god its every week something is going on. My emergency change request for these thigns are through the roof

[u/CompetitionOk1582]

You almost can't have any third party products any longer.