CVE-2026-88778

TCP Initial Sequence Number (ISN) prediction

No known exploitation. EPSS puts it in the 30th percentile. Fixed versions are out.

CVSS 3.17.5High EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products4 fixed builds listed below

Published 2026-09-27Updated 2026-09-29Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Citrix NetScaler ADCAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Affected: < 14.1-73.37 FIPSUpgrade to: 14.1-73.37 FIPSAffected: < 13.1.37.279 FIPS and NDcPPUpgrade to: 13.1.37.279 FIPS and NDcPPStated by: CVE record
Citrix NetScaler GatewayAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Citrix NetScaler ADC or Gateway and record its installed version.
Upgrade 14.1 appliances to 14.1-73.37, or 13.1 appliances to 13.1-64.23.
For FIPS or NDcPP deployments, install 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP.
Until upgraded, limit network access to the appliance to trusted systems and networks.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Exploitation reported in the wild
as reported · Sep 28, 2026·Help Net Security summary
Advisory coverage
as reported · Sep 28, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 6 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.

In plain language

Written by AI from the record

Citrix NetScaler ADC and Gateway devices below the patched releases have a flaw that can let a network attacker interfere with connections, so affected small businesses should act now.

Predictable TCP Initial Sequence Numbers enable unauthenticated network-level packet injection and man-in-the-middle attacks against vulnerable Citrix NetScaler ADC and Gateway appliances.

If you're affected

Session data interception
Altered network traffic
Account session compromise
Service disruption risk

What is it

This is a weakness in how the device starts network conversations. It is like an intruder being able to guess a ticket number well enough to slip a forged message into an ongoing conversation, potentially allowing them to listen to or alter traffic.

Who is affected

This matters to you if you use or run Citrix NetScaler ADC and Gateway appliances. It is a risk when an attacker can reach the device over the network; no login or user action is required.

How urgent is it

Attackers are actively targeting vulnerabilities in the same Citrix NetScaler patch bulletin, making prompt remediation important. Exploitation of CVE-2026-88778 itself has not yet been confirmed, but this flaw is reachable by network attackers without a login and is enabled in the default configuration.

What to do — in detail

Confirm the appliance model, release branch, installed build, and network interfaces that accept traffic. Upgrade standard 14.1 deployments to 14.1-73.37 and standard 13.1 deployments to 13.1-64.23; use 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP where applicable.

Review the vendor advisory before scheduling the upgrade and follow its appliance backup and upgrade procedure. No vendor workaround is listed in the findings; if an upgrade must be delayed, restrict network paths to the appliance with firewall or access-control rules so only necessary trusted systems can reach it. Monitor NetScaler security and system logs, unexpected connection behavior, and configuration changes after remediation. CISA has not listed CVE-2026-88778 in KEV, so there is no KEV remediation due date for this CVE.

Technical context

CVE-2026-88778 is rated CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-342, predictable exact value from previous values. An unauthenticated network attacker can predict TCP Initial Sequence Numbers and inject spoofed packets into active TCP sessions, enabling eavesdropping or man-in-the-middle activity. EPSS is 0.4% and flat (30th percentile). It is not in CISA KEV, and no public exploit code is on record. Reporting confirms exploitation of CVE-2026-88771 and CVE-2026-88772 from the same bulletin, but does not confirm exploitation of CVE-2026-88778.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 2 days, from the signal feeds we watch.

2026-09-29Patch availablerecord updated
2026-09-28Patch availablerecord updated, record updated, record updated
2026-09-27Publishedweakness classified, record updated

Affected products

Citrix NetScaler
- ADC
- Gateway
citrixcommercial · USaka netscaler gateway firmware, application delivery controller firmware, xenserver
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact