What Happened (Plain English)
High-risk Citrix NetScaler ADC weakness requires patching (CVE-2026-88772) affects Citrix NetScaler ADC. FIRST EPSS telemetry places exploitation probability at 76.57%. With a CVSS score of 9.5 (CRITICAL), security teams should verify affected deployments and prioritize remediation according to exposure.
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service Unpatched internet-facing or user-accessible instances risk unauthorized execution, data exposure, or service disruption.
Affected Software & Weakness
Vendor: Citrix NetScaler · Product: ADC · Versions: ADC 0, ADC 0, ADC 0 · CWE: CWE-79
The Fix
Verify your installed ADC version against Citrix NetScaler's official security bulletin for CVE-2026-88772, apply the patched build in a staging ring first when possible, and confirm rollout across all production nodes.
Temporary Workarounds
If patching Citrix NetScaler ADC cannot happen today, place management ports behind VPN or zero-trust access, restrict untrusted network ingress, and enforce multi-factor authentication on administrative sessions.
Detection & Log Checks
Inspect ADC application logs, perimeter firewall denies/allows, and EDR process trees for unusual child processes or outbound connections correlated with CVE-2026-88772 (CWE-79).
Frequently Asked Questions
Is CVE-2026-88772 actively exploited?
No KEV listing yet, but EPSS exploitation probability is 76.57%.
What is the fix for CVE-2026-88772?
Upgrade ADC to >= 14.1-73.37 (CVE-2026-88772 vendor patch).
Which Citrix NetScaler products are affected?
Citrix NetScaler ADC (ADC 0, ADC 0, ADC 0).
How urgent is patching CVE-2026-88772?
Priority queue: THIS-WEEK (CVSS 9.5, EPSS 76.57%).
Official References
Last verified: 2026-11-13 · Defensive checklist only.