Citrix NetScaler Memory Buffer Vulnerability Enables Remote Code Execution
CISA adds two critical NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, urging immediate mitigation to prevent remote code execution or denial of service.
Key points
- Citrix NetScaler ADC and Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability.
- The vulnerabilities can enable remote code execution and denial of service.
- CISA has added CVE-2026-88772 to its KEV Catalog due to active exploitation.
CISA has added a critical vulnerability in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the need for immediate mitigation. The vulnerability, identified as CVE-2026-88772, involves an improper restriction of operations within the bounds of a memory buffer, which could allow for remote code execution or denial of service.
How the Vulnerability Works
The vulnerability arises from an insufficient check when processing certain input data, leading to a buffer overflow. Attackers can exploit this flaw by crafting specific input that causes the NetScaler to execute arbitrary code or crash the service. Citrix has not yet released a patch for this vulnerability, so users are advised to implement mitigations as outlined by CISA.
Mitigations and Compliance
Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Citrix has made indicators of compromise (IoCs) available through NetScaler Console, and published additional guidance in their recent Security Bulletin.
What Should You Do?
- Review Citrix’s advisories and security bulletins.
- Check for indicators of compromise using the provided IoCs.
- Prioritize mitigation based on the risk assessment.
- Follow CISA’s BOD 26-04 for federal agencies and adopt risk-based vulnerability management practices for other organizations.
Background: Indicators of attack
Indicators of attack (IOAs) detect malicious actions as they happen, unlike static indicators of compromise (IOCs) that only confirm past infections. By monitoring for specific behaviors like unusual process spawning or credential dumping, you can stop an intrusion before the attacker achieves their objective.
Read the full guide: Indicators of Attack Explained: Why Behavior Beats Artifacts
What to do and how to stay safe: Citrix
- Application layer logs often miss kernel-level exploits that bypass standard web application firewalls.
- Outbound DNS or HTTP traffic from the appliance usually indicates a reverse shell or data exfiltration.
- Blind spots include misconfigured ACLs that expose administrative ports to public networks.
You must monitor system processes and outbound traffic to detect Citrix NetScaler compromises that bypass application logs. Start by auditing your access control lists and disabling directory listing on all hosted services.
Step-by-step guide: Detect Citrix NetScaler Vulnerabilities: Logs, Tools, and Hidden Blind Spots
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
