NetScaler ADC and Gateway: distinguish the September and October fixes before recovery

What it is

Status as of 25 October 2026. This comparison uses CTX697096's 27 September 2026 revision and CTX697174's 3 October 2026 revision. Re-check both bulletins, supported upgrade paths and current indicator-detection logic before acting.

Citrix confirms exploitation of CVE-2026-88771, an unauthenticated command-execution flaw without a feature prerequisite, and CVE-2026-88772, a memory overflow affecting DTLS-enabled deployments. DTLS is enabled by default on VPN virtual servers. Separately, CVE-2026-88779 concerns denial of service on appliances configured as a SAML service provider or identity provider; CISA added it to its Known Exploited Vulnerabilities catalogue on 4 October 2026. September bulletin, October bulletin.

Why it matters

The two bulletins have different patch floors. A deployment can satisfy the earlier bulletin while remaining affected by the later SAML issue. Both concern customer-managed appliances; the vendor handles its managed cloud services. Feature checks identify applicability, while compromise investigation determines whether recovery must go beyond upgrading.

How to apply

• Record each node's running build and inspect its configuration, using show ns runningConfig where appropriate. Check DTLS settings and SAML service-provider or identity-provider configuration. Do not assume that disabling DTLS removes exposure to the flaw without a feature prerequisite.
• Match the installed branch to the vendor's fixed-build table. Versions below each listed threshold are affected within that branch, subject to the relevant feature prerequisites. Use the appropriate fixed release or a later supported release in the same branch.

Branch	CVE-2026-88771/88772 fix	CVE-2026-88779 fix
ADC/Gateway 14.1	14.1-73.37	14.1-73.41
ADC/Gateway 13.1	13.1-64.23	13.1-64.28
ADC 14.1-FIPS	14.1-73.37 FIPS	14.1-73.41 FIPS
ADC 13.1-FIPS/NDcPP	13.1-37.279	13.1-37.282

The earlier bulletin also writes the last build as 13.1.37.279; confirm package naming in the download portal. Build tables, SAML build table.

• Before recovery, preserve configuration, logs, time settings and a support bundle; arrange any memory capture with responders because the documented Packet Engine dump causes a warm restart. For a suspected compromise, isolate the appliance and investigate connected authentication and management systems. Recovery procedure.
• Run the available NetScaler Console scan from Security Advisory, meeting its telemetry prerequisite. Investigate Potentially Compromised results. Failed to Execute and Skipped are not negative findings. Retain scan history and the detection-logic revision; the vendor warns that indicators cannot detect every compromise. Console documentation.
• Treat session termination as an incident-containment decision after evidence collection and upgrades on all nodes. kill aaa session -all disconnects active AAA-TM/VPN sessions; show aaa session displays connections for subsequent review. Coordinate the user interruption and address other session types separately. These commands are not a universal post-upgrade requirement in the two bulletins. Command reference.
• If compromise is suspected, follow the platform-specific wipe or replacement procedure, install fixed firmware, and restore a verified pre-compromise configuration. Replace exposed service secrets, user credentials and certificates, then rotate restored local passwords and key-encryption keys. Verify configuration and management restrictions; Citrix specifies close monitoring for at least 90 days after recovery.

Pitfalls

A patch, session disconnect and clean indicator scan answer different questions. None alone establishes that an earlier intrusion left no persistence. Keep management services off the public internet and retain the evidence needed to investigate unexpected configuration changes.