Main Vulnerability Database Vulnerabilities #VU152298

Predictable Exact Value from Previous Values in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2026-88778

Published: September 28, 2026

Vulnerability identifier: #VU152298

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-88778

CWE-ID: CWE-342

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to predict TCP initial sequence numbers.

The vulnerability exists due to predictable TCP initial sequence numbers in TCP configuration when establishing TCP connections. A remote attacker can predict TCP initial sequence numbers to predict TCP initial sequence numbers.

Exploitation requires enhanced ISN generation to be disabled.

Affected software

Citrix Netscaler ADC
Citrix NetScaler Gateway

How to mitigate CVE-2026-88778

Install security update from vendor's website.

Citrix Netscaler ADC - addressed in versions 13.1-37.279, 13.1-64.23, 14.1-73.37
Citrix NetScaler Gateway - addressed in versions 13.1-64.23, 14.1-73.37

External References

Related Security Bulletins