High Threat Security Alert (A26-09-41): Multiple Vulnerabilities in Citrix Products

Description:

Citrix has released security updates to address multiple vulnerabilities in several Citrix products or components. A remote attacker could entice a user to open a web page with specially crafted content on a vulnerable browser to exploit the vulnerabilities.

Reports indicated that remote code execution vulnerabilities (CVE-2026-88771 and CVE-2026-88772) are being exploited in the wild. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Affected Systems:

• Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway 13.1 prior to version 13.1-64.23
• Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway 14.1 prior to version 14.1-73.37
• Citrix NetScaler Application Delivery Controller (ADC) FIPS prior to version 14.1-73.37 FIPS
• Citrix NetScaler Application Delivery Controller (ADC) FIPS and NDcPP prior to version 13.1-37.279

For detailed information of the affected systems, please refer to the corresponding security advisories at vendor's website.

Impact:

Successful exploitation of the vulnerabilities could lead to remote code execution, denial of service or security restriction bypass on an affected system.

Recommendation:

Patches for affected systems are now available. Administrators of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

More Information:

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88771 (to CVE-2026-88778)