CVE-2026-88772: Citrix NetScaler RCE/DoS Vulnerability

Overview

CVE-2026-88772 identifies an improper restriction of operations within the bounds of a memory buffer vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. This vulnerability poses a critical risk, allowing unauthenticated remote attackers to achieve remote code execution (RCE) or cause a denial of service (DoS) on affected appliances. Immediate patching is crucial for all organizations utilizing these products.

Technical Analysis

This vulnerability, classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), exists in specific versions of Citrix NetScaler ADC and NetScaler Gateway. Exploitation can lead to either full remote code execution, granting an attacker arbitrary control over the appliance, or a denial of service, rendering the device inoperable.

• Affected Products: Citrix NetScaler ADC and Citrix NetScaler Gateway.
• Affected Versions:
  • ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP.
  • Gateway: before 14.1-73.37 and before 13.1-64.23.
• Impact: Remote Code Execution (RCE) or Denial of Service (DoS).
• Attack Vector: Network-based, likely exploiting a service exposed by the NetScaler appliance.

Detection

Detecting exploitation of CVE-2026-88772 requires vigilant monitoring of NetScaler appliance logs and behavior. Look for the following indicators:

• Unexpected Process Creation: Monitor for the creation of unusual or unauthorized processes on the NetScaler appliance, especially shell processes (sh, bash, cmd.exe, powershell.exe) or other executables spawned by NetScaler services.
• Abnormal Resource Utilization: Sudden and sustained spikes in CPU, memory, or network traffic on the NetScaler appliance, potentially indicating a DoS attack or resource-intensive RCE payload execution.
• Suspicious Log Entries: Review NetScaler system logs for error messages, crashes, or unusual access patterns that deviate from baseline behavior.
• Network Anomalies: Monitor network traffic to and from the NetScaler for unusual connections, data exfiltration attempts, or command-and-control (C2) communications originating from the appliance.

Sigma Detection Rules

Citrix NetScaler – Suspicious Process Creation (Linux)

title: Citrix NetScaler - Suspicious Process Creation (Linux)
id: 00000000-0000-4000-8000-000000000001
status: experimental
description: Detects suspicious process creation on a Linux-based Citrix NetScaler appliance, indicative of potential RCE exploitation. This rule targets common shell or utility execution from NetScaler-related parent processes.
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    - ParentProcessName|contains: 'netscaler'
    - ParentProcessName|contains: 'nsd'
    - ParentProcessName|contains: 'httpd'
  selection_child:
    - ProcessName|endswith: ['sh', 'bash', 'dash', 'zsh', 'python', 'perl', 'php', 'nc', 'wget', 'curl', 'chmod', 'chown', 'rm', 'mkdir', 'tar', 'unzip', 'openssl']
    - CommandLine|contains: ['/bin/sh', '/bin/bash', '/usr/bin/python', '/usr/bin/perl', 'wget ', 'curl ']
  condition: selection_parent and selection_child
level: critical

Mitigations

Prioritize the following actions to mitigate the risk posed by CVE-2026-88772:

1. Apply Patches Immediately: Upgrade all affected Citrix NetScaler ADC and Gateway appliances to the patched versions as recommended by Citrix. Refer to the official Citrix security bulletin for specific update instructions.
2. Network Segmentation and Access Control: Restrict network access to NetScaler management interfaces and critical services to only trusted IP addresses and necessary personnel. Implement strict firewall rules.
3. Regular Backups: Ensure regular and verified backups of NetScaler configurations and system images to facilitate rapid recovery in case of a successful DoS attack or compromise.
4. Enhanced Monitoring: Implement robust logging and monitoring solutions for NetScaler appliances, forwarding logs to a SIEM for real-time analysis and alerting on suspicious activities.

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1499 — Endpoint Denial of Service