CVE-2026-88772: listed in the CISA KEV catalog

CVE-2026-88772 · KEV 2026-09-27 · patch available

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Is CVE-2026-88772 exploited?

• Listed in the CISA KEV catalog on 2026-09-27.
• Federal remediation due 2026-09-30.
• Past that date by 1 days.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Citrix Systems · NetScaler · ADC <14.1-73.37
• Citrix Systems · NetScaler · Gateway <13.1-64.23
• Citrix Systems · NetScaler · ADC NDcPP <13.1-37.279
• Citrix Systems · NetScaler · ADC FIPS <14.1-73.37
• Citrix Systems · NetScaler · Gateway <14.1-73.37
• Citrix Systems · NetScaler · ADC <13.1-64.23
• Citrix Systems · NetScaler · ADC FIPS <13.1-37.279
• Citrix NetScaler · ADC · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23, >= 0, < 14.1-73.37 FIPS, >= 0, < 13.1.37.279 FIPS and NDcPP
• Citrix NetScaler · Gateway · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23

Is there a patch?

• NetScaler ADC 14.1-73.37
• NetScaler Gateway 13.1-64.23
• NetScaler ADC NDcPP 13.1-37.279
• NetScaler ADC FIPS 14.1-73.37
• NetScaler Gateway 14.1-73.37
• NetScaler ADC 13.1-64.23
• NetScaler ADC FIPS 13.1-37.279

What PlainSec published about CVE-2026-88772

• Citrix NetScaler DTLS Bug Hits VPN Gateways (2026-10-01)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No CVSS score from NVD.
• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-09-29.