轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202610-00000003

[內容說明]
Citrix旗下NetScaler ADC (原名為Citrix ADC)是一款網路設備，專為優化、保護及管理企業應用程式與雲端服務而設計；NetScaler Gateway (原名為Citrix Gateway)則提供安全的遠端存取解決方案，讓使用者能夠從任何地點安全存取應用程式和資料。近日，Citrix發布重大資安漏洞公告(CVE-2026-88771，CVSS 4.x：9.5、CVE-2026-88772，CVSS 4.x：9.5、CVE-2026-88773，CVSS 4.x：9.3)。 其中，CVE-2026-88771和CVE-2026-88772已觀察到有攻擊者利用此漏洞，建議儘速採取暫時緩解措施，以防止針對此漏洞可能的攻擊發生。
CVE-2026-88772，此為記憶體溢位漏洞，可導致遠端任意程式碼執行(RCE)或阻斷服務(DoS)。
CVE-2026-88773，此漏洞為HTTP請求解析不一致。
CVE-2026-88771，此為輸入驗證不當漏洞，可允許未經身分驗證的攻擊者遠端執行任意程式碼(RCE)。

[影響平台]
NetScaler ADC與NetScaler Gateway 14.1-73.37(不含)以前版本、 NetScaler ADC與NetScaler Gateway 13.1-64.23(不含)以前版本、 NetScaler ADC FIPS 14.1-73.37(不含)以前版本、 NetScaler ADC FIPS與NDcPP 13.1-37.279(不含)以前版本

[建議措施]
請更新至以下版本： NetScaler ADC 和 NetScaler Gateway 14.1-73.37 (含)之後版本、 NetScaler ADC 和 NetScaler Gateway 13.1-64.23 (含)之後版本、 NetScaler ADC FIPS 14.1-73.37(含)之後版本、 NetScaler ADC FIPS與NDcPP 13.1-37.279(含)之後版本

[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-11256-646ba-1.html

Forwarded from Taiwan Computer Emergency Response Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000003

[Content Description]
NetScaler ADC, a product of Citrix (formerly known as Citrix ADC), is a network appliance designed to optimize, protect, and manage enterprise applications and cloud services; NetScaler Gateway (formerly known as Citrix Gateway) provides a secure remote access solution that allows users to securely access applications and data from any location. Recently, Citrix released an advisory regarding major security vulnerabilities (CVE-2026-88771，CVSS 4.x：9.5、CVE-2026-88772，CVSS 4.x：9.5、CVE-2026-88773，CVSS 4.x：9.3). Exploitation of CVE-2026-88771 and CVE-2026-88772 by attackers has been observed. It is recommended to implement temporary mitigation measures as soon as possible to prevent potential attacks exploiting these vulnerabilities. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution (RCE) or denial of service (DoS). CVE-2026-88773 is an HTTP request parsing inconsistency vulnerability. CVE-2026-88771 is an improper input validation vulnerability that may allow unauthenticated attackers to remotely execute arbitrary code (RCE).

[Affected Platforms]
NetScaler ADC and NetScaler Gateway versions 14.1-73.37(exclusive) and earlier, NetScaler ADC and NetScaler Gateway versions 13.1-64.23(exclusive) and earlier, NetScaler ADC FIPS versions 14.1-73.37(exclusive) and earlier, NetScaler ADC FIPS and NDcPP versions 13.1-37.279(exclusive) and earlier

[Recommended Measures]
Please update to the following versions: NetScaler ADC and NetScaler Gateway versions 14.1-73.37 (inclusive) or later, NetScaler ADC and NetScaler Gateway versions 13.1-64.23 (inclusive) or later, NetScaler ADC FIPS versions 14.1-73.37(inclusive) or later, NetScaler ADC FIPS and NDcPP versions 13.1-37.279(inclusive) or later

[References]
1. https://www.twcert.org.tw/tw/cp-169-11256-646ba-1.html