Forwarded from Taiwan Computer Emergency Response Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000003

[Content Description]
NetScaler ADC, a product of Citrix (formerly known as Citrix ADC), is a network appliance designed to optimize, protect, and manage enterprise applications and cloud services; NetScaler Gateway (formerly known as Citrix Gateway) provides a secure remote access solution that allows users to securely access applications and data from any location. Recently, Citrix released an advisory regarding major security vulnerabilities (CVE-2026-88771，CVSS 4.x：9.5、CVE-2026-88772，CVSS 4.x：9.5、CVE-2026-88773，CVSS 4.x：9.3). Exploitation of CVE-2026-88771 and CVE-2026-88772 by attackers has been observed. It is recommended to implement temporary mitigation measures as soon as possible to prevent potential attacks exploiting these vulnerabilities. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution (RCE) or denial of service (DoS). CVE-2026-88773 is an HTTP request parsing inconsistency vulnerability. CVE-2026-88771 is an improper input validation vulnerability that may allow unauthenticated attackers to remotely execute arbitrary code (RCE).

[Affected Platforms]
NetScaler ADC and NetScaler Gateway versions 14.1-73.37(exclusive) and earlier, NetScaler ADC and NetScaler Gateway versions 13.1-64.23(exclusive) and earlier, NetScaler ADC FIPS versions 14.1-73.37(exclusive) and earlier, NetScaler ADC FIPS and NDcPP versions 13.1-37.279(exclusive) and earlier

[Recommended Measures]
Please update to the following versions: NetScaler ADC and NetScaler Gateway versions 14.1-73.37 (inclusive) or later, NetScaler ADC and NetScaler Gateway versions 13.1-64.23 (inclusive) or later, NetScaler ADC FIPS versions 14.1-73.37(inclusive) or later, NetScaler ADC FIPS and NDcPP versions 13.1-37.279(inclusive) or later

[References]
1. https://www.twcert.org.tw/tw/cp-169-11256-646ba-1.html