Sessionwright

Known exploitedPitScalerCISA forensic triage

CVE-2026-88772: what NetScaler® admins need to do

CVE-2026-88772 (memory overflow) affects NetScaler ADC and Gateway. In CISA KEV since 2026-09-27. Fixed in 14.1-73.37 / 13.1-64.23. Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2026-88772Request an emergency upgrade

Fixed again since. CTX697174 (2026-10-03) fixed CVE-2026-88779 in 14.1-73.41 / 13.1-64.28. Then CTX697191 (2026-10-08) fixed CVE-2026-107406 in 14.1-73.46 / 13.1-64.29. Upgrade to the current safe build, not only the first fixed build for CVE-2026-88772.

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1-73.37 / 13.1-64.23First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2026-09-27, federal due date 2026-09-30. Known ransomware use: Unknown.
Forensic triage
Yes. CISA flags this CVE for forensic triage: preserve evidence (snapshot, logs) before patching.
CVSS
9.5 (CVSS v4.0, vendor score in CTX697096)
Preconditions
DTLS enabled on a VPN vserver (ON by default)
Session kill advised
No. The bulletin does not call for session termination. Community guidance recommends it (see After patching).

Fixed builds from the Citrix® security bulletin CTX697096

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.114.1-73.3714.1-73.46
NetScaler 14.1 FIPS14.1-73.37 FIPS14.1-73.46 FIPS
NetScaler 13.1Past end of maintenance13.1-64.2313.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.279 FIPS13.1-37.283 FIPS

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler).

Our advisory data, taken from CTX697096, summarises it as: DTLS memory overflow leading to RCE. Vulnerability class: memory overflow (CWE-119). Precondition: DTLS enabled on a VPN vserver (ON by default).

For the full description, read the CVE.org record for CVE-2026-88772 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: DTLS enabled on a VPN vserver (ON by default). Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2026-88772 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2026-88772 highlighted

How to patch

Evidence first. CISA flags CVE-2026-88772 for forensic triage. Preserve evidence (snapshot, logs) before you patch, then upgrade, then run the IoC checks below.

  1. Choose the target build: at least 14.1-73.37 on 14.1 or 13.1-64.23 on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

If you cannot upgrade yet

  • CVE-2026-88772: set vpn vserver <name> -dtls OFF and block inbound UDP/443

Interim measures reduce exposure; only the fixed build removes the vulnerability.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin

The bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.

Additional steps from CISA, CERTs and researchers

community guidance
kill aaa session -all
kill icaconnection -all
kill pcoipConnection -all
kill rdp connection -all
clear lb persistentSessions
  • kill aaa session -all: Poppelgaard: kill all five session types
  • Snapshot the VPX / collect logs and memory BEFORE patching (BOD 26-04 forensic triage; NCSC-NL: keep memory and at least 1 month of logs)
  • Revoke sessions and rotate credentials (Mandiant)

Run session kills only after every HA or cluster node is on the fixed build.

Configuration changes for other CVEs in CTX697096

  • CVE-2026-88778: enable Enhanced ISN generation

    set ns tcpParam -enhancedISNgeneration ENABLED

    NITRO attribute nstcpparam.enhancedisngeneration verified in the NITRO reference; the CLI spelling comes from third parties.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • PitScaler (WHIPSHOT/SLAPSHOT) indicators

    • /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
    • /vpn/scripts/linux/nsg64.deb and nsgclient18.deb
    • /tmp/.uxdport, /tmp/.uxdlock
    • Edited /etc/httpd.conf (AliasMatch / AddHandler)
    • setuid /bin/sh; /var/netscaler/.ns_suidcmd
    • 'pitboss ... NSPPE' log lines containing IFS or b64decode
    • Abuse of /netscaler/ns_monuploadd_err.pl
    ls -la /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /vpn/scripts/linux/nsg64.deb /vpn/scripts/linux/nsgclient18.deb /tmp/.uxdport /tmp/.uxdlock /var/netscaler/.ns_suidcmd
ls -la /bin/sh
grep -nE 'AliasMatch|AddHandler' /etc/httpd.conf
zgrep -E 'pitboss.*(IFS|b64decode)' /var/log/ns.log*

    Tools: NetScaler Console IoC scan, watchTowr detection artefact generator, netscaler-ctx697096-checker, NCSC-NL scripts, Unit 42 'pitboss' hunting query

    Source: Unit 42; Mandiant/GTIG; NCSC-NL; Poppelgaard

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX697096 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date
  4. Later bulletin CTX697174 (CVE-2026-88779) raises the safe build to 14.1-73.41 / 13.1-64.28
  5. Later bulletin CTX697191 (CVE-2026-107406) raises the safe build to 14.1-73.46 / 13.1-64.29

Related CVEs

  • CVE-2026-88771(PitScaler)Unauthenticated command injection (default configuration)CISA KEVSame bulletin (CTX697096)
  • CVE-2026-88773PitScaler: HTTP request smugglingNot in KEVSame bulletin (CTX697096)
  • CVE-2026-88774PitScaler: policy bypassNot in KEVSame bulletin (CTX697096)
  • CVE-2026-88775PitScaler: memory overflowNot in KEVSame bulletin (CTX697096)
  • CVE-2026-88776PitScaler: memory overflowNot in KEVSame bulletin (CTX697096)
  • CVE-2026-88777PitScaler: memory overflowNot in KEVSame bulletin (CTX697096)
  • CVE-2026-88778PitScaler: TCP initial sequence number prediction (needs Enhanced ISN as well as the upgrade)Not in KEVSame bulletin (CTX697096)
  • CVE-2026-88779SAML memory overflow (vendor: DoS; RCE suspected)CISA KEVLater fix (CTX697174)
  • CVE-2026-107406Memory overflow leading to RCE or DoSNot in KEVLater fix (CTX697191)
Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2026-88772: questions

Which NetScaler builds fix CVE-2026-88772?

Vendor bulletin CTX697096 fixes CVE-2026-88772 in 14.1-73.37 (NetScaler 14.1), 14.1-73.37 FIPS (NetScaler 14.1 FIPS), 13.1-64.23 (NetScaler 13.1) and 13.1-37.279 FIPS (NetScaler 13.1 FIPS/NDcPP). As of 2026-10-15, the current safe builds, which also include later fixes, are 14.1-73.46, 14.1-73.46 FIPS, 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2026-88772 exploited in the wild?

Yes. CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities catalog on 2026-09-27, with a federal remediation due date of 2026-09-30. Known ransomware campaign use: Unknown. CISA also flags it for forensic triage, so preserve evidence before you patch.

Do I need to kill sessions after patching CVE-2026-88772?

The bulletin does not call for session termination. Community guidance recommends kill aaa session -all, kill icaconnection -all, kill pcoipConnection -all, kill rdp connection -all and clear lb persistentSessions after every node is upgraded; it is labelled as community guidance on this page.

Check every appliance, not just one, for CVE-2026-88772

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment