How to verify NetScaler ADC and Gateway remediation for exploited CVE-2026-88771 and CVE-2026-88772

Citrix's NetScaler advisory published on 27 September 2026 confirms that two of the vulnerabilities it covers, CVE-2026-88771 and CVE-2026-88772, were already exploited in the wild. A walkthrough posted on dev.to uses that fact to argue for a stricter definition of done: closing a change ticket proves a maintenance activity happened, not that an appliance is actually fixed.

Read the build string on the running appliance

The first checkpoint in the dev.to post is the version string taken from the device itself rather than from the change record. The fixed builds named by Citrix, and repeated by NCSC-NL and CERT-FR, are 14.1-73.37 and later on the 14.1 branch of ADC and Gateway, 13.1-64.23 and later on 13.1, 14.1-73.37 FIPS and later for ADC FIPS, and 13.1-37.279 and later for ADC FIPS and NDcPP. A ticket closed against an older build leaves the appliance inside the affected range, which is why the check belongs against the running system.

Re-check which roles carried the prerequisites

Several flaws in the bundle apply only depending on how the appliance is used, so the post recommends verifying configuration after the upgrade. CVE-2026-88772 requires DTLS, which Citrix describes as enabled by default on a VPN virtual server. CVE-2026-88773 requires HTTP enabled. CVE-2026-88775 applies to Gateway roles such as SSL VPN, ICA Proxy, CVPN and RDP Proxy, or to an AAA virtual server. CVE-2026-88776 requires an Oracle-type load-balancing virtual server, and CVE-2026-88777 requires load-balancing, content-switching or CGNAT LSN/NAT64 configuration using a non-HTTP Layer 7 protocol. Re-checking these settings also catches defaults that were inherited when objects were created and never revisited.

Preserve evidence before the change, review it after

Because exploitation preceded the fixes, NCSC-NL advises preserving relevant logging and a memory dump before installing the update, reviewing that material afterwards, and checking the indicators of compromise Citrix published through the NetScaler console. The dev.to post frames this as the difference between preventing further abuse and answering whether abuse already occurred, and recommends attaching logs, the build string, the running configuration and any crash material directly to the change record rather than merely referencing them.

Cover the estate, not the appliances someone remembered

Patch campaigns tend to reach the devices operators recall, the post notes, so failover and standby units must be checked independently: a switchover during an incident would move traffic onto whatever the standby is running. Hybrid Secure Private Access deployments that use NetScaler instances belong in the same verification pass. Two items the post says are worth recording even after a clean verification are whether any indicator from the exposure period remains unreviewed, and whether Citrix-managed components are in scope, since those are updated by Cloud Software Group under a separate arrangement while the advisory covers customer-managed appliances.

What the internet scan shows

A ZoomEye query for a NetScaler fingerprint matched 239,201 assets at query time, while a CVE-specific filter for CVE-2026-88772 returned no matches. The post cautions against treating either number as an exposure estimate: the zero reflects index timing for a recent disclosure, and a fingerprint match only indicates that a device presents as NetScaler ADC or Gateway, not that it is confirmed vulnerable.

Why it matters

ADC and Gateway appliances sit on the network edge and terminate VPN and load-balancing traffic, and both headline CVEs were exploited before patches existed. Installing a fixed build is therefore necessary but not sufficient: teams also need evidence about what happened during the exposure window and assurance that every unit in the estate, including standbys, is running a fixed build. The verification sequence in the dev.to post, covering build string, role-dependent configuration, evidence capture and whole-estate coverage, generalises to any actively exploited edge vulnerability. The primary sources it points to, Citrix bulletin CTX697096, NCSC-NL advisory NCSC-2026-0394 and CERT-FR alerts CERTFR-2026-ALE-011 and CERTFR-2026-AVI-1235, carry the authoritative detail.