Citrix products: multiple vulnerabilities | 09/28
The HKCERT advisory confirms that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. Check the impact against your product and deployment conditions.
Basis: the official source labels this critical. GDMME follow-up priority uses official ratings and headline/summary rules. It is not a CVSS score or official vulnerability rating, and does not confirm that your business is affected.
Source severity
極高度風險（HKCERT）
Affected scope
Scope listed in the advisory: NetScaler ADC and NetScaler Gateway 14.1 versions earlier than 14.1-73.37; NetScaler ADC and NetScaler Gateway 13.1 versions earlier than 13.1-64.23; Versions earlier than NetScaler ADC FIPS 14.1-73.37 FIPS; Versions earlier than NetScaler ADC FIPS and NDcPP 13.1-37.279.
Official recommendations
Automatically extracted recommendation passages from the official source, retained in the source language. Check the complete advisory.
- 在安裝軟體之前 請先瀏覽供應商之網站 以獲得更多詳細資料
- 安裝供應商提供的修補程式：
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
The last successful extraction is used here. Check the official source for the latest content.
Source text collected (Hong Kong time)：2026/10/12 02:44 HKT
官方原文建議自動摘錄 未作逐篇人工分析或翻譯；請核對完整公告、現行版本及適用性
GDMME recommended actions
GDMME recommendations · automatically organised from explicit products and source signals, without individual human analysis. Confirm applicability against vendor guidance and your environment.
- Locate Citrix NetScaler deployments, running versions and service owners in your inventory or management console; compare them with the vendor applicability criteria. A named product does not mean every deployment is affected.
- Check internet-reachable management interfaces, VPN access and administrator accounts on Citrix NetScaler. Restrict unnecessary exposure using vendor guidance after confirming administration and remote-work needs.
- Once Citrix NetScaler applicability is confirmed, check the official excerpt and complete vendor patch/mitigation instructions. Record before/after versions, test results and rollback steps; do not install updates solely from a news headline.
- Review administrator sign-ins, configuration changes and VPN sessions on Citrix NetScaler against authorised changes. Preserve logs and use the incident procedure for unfamiliar admin accounts or unauthorised changes.
Automatically organised (Hong Kong time)：2026/10/12 23:05 HKT
Educational information only. Confirm affected versions, mitigations and exploitation status with the original vendor advisory. Reports do not imply that GDMME equipment blocks every vulnerability.