Vulnerability in Citrix UniconOS leading to Arbitrary file read and write

This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

Vulnerability in Citrix UniconOS leading to Persistent Command Execution

This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows.

This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.

Out-of-bounds write vulnerability in Citrix Workspace app for Windows.

This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1.

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.

This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.

NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:

For the following versions: Applicable only when configured as a SAML IdP: NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

NetScaler ADC and NetScaler Gateway before 14.1-73.37  NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS  NetScaler ADC and NetScaler Gateway before 13.1-64.23 NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

As I haven't seen any post on here I thought im gonna share it: It seems like the vulnerability from sunday (CVE-2026-88771 and CVE-2026-88772) isn't fully fixed.

According to Kevin Beaumont another method through SAML requests (but similiar to the ones from sunday) executes malicious code.

Citrix has published a blog entry saying "This issue is independent of the vulnerabilities disclosed in CTX697096.". There are two posts on the r/Citrix subreddit that contain IoCs which are useful.

Post 1: netscaler active exploit after patch Post 2: Vulnerability Scans causing Netscaler reboots

Citrix has disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway; including two actively exploited.

NetScaler ADC and NetScaler Gateway sit at the network perimeter, handling VPN, remote access, load balancing, and authentication for enterprise environments, making compromise a high-impact event with broad downstream consequences.

CVE-2026-88771 | 9.5 Critical | Improper Input Validation

An unauthenticated attacker can exploit this vulnerability to run arbitrary commands on the appliance.  This vulnerability affects all NetScaler ADC and NetScaler Gateway deployments on an affected version, including those in the default configuration.

CVE-2026-88772 | 9.5 Critical | Memory Overflow

An attacker can exploit this vulnerability to achieve remote code execution or cause a denial-of-service condition.  This vulnerability affects appliances with DTLS enabled, which is on by default for VPN virtual servers on NetScaler Gateway.

Citrix has confirmed that both vulnerabilities have been exploited in the wild against unmitigated NetScaler deployments, and both have been added to the CISA Known Exploited Vulnerabilities catalog.

Other vulnerabilities included in the advisory, but not reported as actively exploited

CVE-2026-88773 | 9.3 Critical | HTTP Request Smuggling  CVE-2026-88774 | 7.0 High | Policy Bypass  CVE-2026-88775 | 8.8 High | Memory Overflow  CVE-2026-88776 | 8.8 High | Memory Overflow  CVE-2026-88777 | 8.8 High | Memory Overflow  CVE-2026-88778 | 8.8 High | TCP Initial Sequence Number (ISN) Prediction

Recommendations

Immediate Action: Apply Citrix-released updates to all affected NetScaler ADC and NetScaler Gateway appliances immediately.  Restrict NetScaler management interfaces to trusted internal networks and administrative hosts.  Review vulnerable appliances for signs of unauthorized access or persistence, including systems already patched.  Monitor authentication activity and connections from NetScaler appliances for suspicious or unexpected behavior.  Rotate credentials, certificates, and secrets if compromise or unauthorized access is suspected.

References

Citrix Advisory

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

Out-of-bounds read vulnerability in Citirx Workspace app for Windows.

This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows.

This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

anyone else recently have issues with appfw rules being copied over after recent firmware updates? seems tied to the signatures being used in that after firmware installation the appfw policies and profiles are non existent on the "new" firmware. the signatures however are still intact, but when creating new profiles and using the existing signatures an error about fastmatch not found for signature line

<SignatureRule actions="block,log" category="web-misc" enabled="ON" id="400008" source="Citrix" sourceid="" type="DenyListHttpRequest" version="1" cpu="LOW" year="2026" severity="HIGH">

<LogString>Mitigation signature for CVE-2026-10816</LogString>

</SignatureRule>

i have many signature files and they all seem to have this issue. the new "default" of course i missing this line, so i feel like this was some bug at some point coming home to roost. the ID number looks very low too as the new rules are typically 9xxxxx etc. the version on all the files is 181 so they are "current"

very sus...

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.

This issue affects WorkSpace App: 2607.