All news & advisories

Actively exploited September 28, 2026

CVE-2026-88772: Actively Exploited Vulnerability

CVE-2026-88772 CVSS 8.1 CISA KEV · actively exploited

Who it affects: See the summary below.
What to do: Patch immediately — prioritise internet-facing systems.

CVE-2026-88772: Citrix NetScaler ADC/Gateway RCE/DoS

Severity: HIGH (CVSS 8.1)
KEV Status: Exploited in the wild

Affected Products

Citrix NetScaler ADC: versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, before 13.1.37.279 FIPS/NDcPP
Citrix NetScaler Gateway: versions before 14.1-73.37, before 13.1-64.23

Impact

Remote Code Execution or Denial of Service

Remediation

Apply the following patches immediately:

NetScaler ADC: Update to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279 FIPS/NDcPP
NetScaler Gateway: Update to 14.1-73.37 or 13.1-64.23

Refer to Citrix Security Bulletin CTX697096 for additional details and guidance.

Data as of September 28, 2026. Sources: nvd.nist.gov, support.citrix.com, cisa.gov. Figures are pulled from public vendor and security data and refreshed automatically.

Back to all news & advisories