Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway

Citrix has patched 8 vulnerabilities in NetScaler ADC and NetScaler Gateway affecting versions 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, including FIPS variants. Three vulnerabilities are rated critical: CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution via insufficient input validation affecting all deployments; CVE-2026-88772 (CVSS 9.5) is a memory overflow enabling RCE or DoS when DTLS is enabled (on by default for VPN); CVE-2026-88773 (CVSS 9.3) enables HTTP Request Smuggling without authentication. Five additional high-severity vulnerabilities (CVSS 7.0-8.8) cover policy bypass, memory overflows, and predictable TCP ISNs. Citrix has confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 in the wild. The advisory applies only to customer-managed deployments; Citrix-managed cloud services are updated separately. Secure Private Access Hybrid deployments using NetScaler instances are also affected.