SB2026092701 - Multiple vulnerabilities in Citrix NetScaler
Published: September 27, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-88771) Exploited
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an unspecified issue. A remote non-authenticated attacker can send specially crafted requests to the affected system and execute arbitrary code.
Note, the vulnerability is being actively exploited in the wild as per watchTowr sources.
2) Buffer overflow (CVE-ID: CVE-2026-88776)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or trigger unpredictable or erroneous behavior.
The vulnerability exists due to a memory overflow in Oracle load-balancing virtual servers when processing requests. A remote attacker can send crafted input to cause a denial of service or trigger unpredictable or erroneous behavior.
The issue requires a load-balancing virtual server configured with the Oracle type.
3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-88773)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify information.
The vulnerability exists due to inconsistent interpretation of HTTP requests in HTTP configuration when handling HTTP requests. A remote attacker can send a smuggled HTTP request to modify information.
HTTP configuration must be enabled.
4) Buffer overflow (CVE-ID: CVE-2026-88772) Exploited
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 9.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to a memory overflow in DTLS-enabled virtual servers when processing DTLS traffic. A remote attacker can send crafted input to execute arbitrary code or cause a denial of service.
DTLS must be enabled; it is enabled by default on VPN virtual servers.
Note, the vulnerability is being actively exploited in the wild.
5) Buffer overflow (CVE-ID: CVE-2026-88777)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or trigger unpredictable or erroneous behavior.
The vulnerability exists due to a memory overflow in LB/CS and CGNAT-LSN/NAT64 configurations when processing non-HTTP layer 7 protocol traffic. A remote attacker can send crafted input to cause a denial of service or trigger unpredictable or erroneous behavior.
The issue requires a non-HTTP layer 7 protocol feature to be enabled.
6) Predictable Exact Value from Previous Values (CVE-ID: CVE-2026-88778)
CWE-ID: CWE-342 - Predictable Exact Value from Previous Values
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to predict TCP initial sequence numbers.
The vulnerability exists due to predictable TCP initial sequence numbers in TCP configuration when establishing TCP connections. A remote attacker can predict TCP initial sequence numbers to predict TCP initial sequence numbers.
Exploitation requires enhanced ISN generation to be disabled.
7) Configuration (CVE-ID: CVE-2026-88774)
CWE-ID: CWE-16 - Configuration
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass feature policies.
The vulnerability exists due to improper HTTP URL based expression usage in policy expressions when evaluating HTTP URL based expressions. A remote attacker can exploit the policy expression to bypass feature policies.
8) Buffer overflow (CVE-ID: CVE-2026-88775)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or trigger unpredictable or erroneous behavior.
The vulnerability exists due to a memory overflow in Gateway and AAA virtual servers when processing requests. A remote attacker can send crafted input to cause a denial of service or trigger unpredictable or erroneous behavior.
The affected configurations are Gateway virtual servers, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy, and AAA virtual servers.
Remediation
Install update from vendor's website.
References
- https://x.com/watchtowrcyber/status/2103891689857228803
- https://x.com/watchtowrcyber/status/2103972792043479307
- https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
- https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
- https://support.citrix.com/support-home/topic-article-list?trendingCategory=20&trendingTopicName=Security%20Bulletin