A patch plan for CVE-2026-88773 that accounts for FIPS, NDcPP and hybrid deployments

The straightforward part

CVE-2026-88773 is one of eight flaws fixed in Citrix bulletin CTX697096 for NetScaler ADC and Gateway. It is rated CVSS 9.3, requires HTTP functionality to be enabled, and requires no authentication. Applying the vendor update is the fix.

The complication is in the version list

The bulletin does not describe one target version. Fixed builds are 14.1-73.37 for NetScaler ADC and Gateway 14.1, 13.1-64.23 for the 13.1 line, 14.1-73.37 FIPS for ADC FIPS, and 13.1-37.279 for ADC FIPS with NDcPP. Four different targets mean four different change tracks.

FIPS and NDcPP are not afterthoughts

FIPS-validated and NDcPP-certified deployments usually carry stricter change control and lengthier validation. They are also commonly the instances with the least flexibility. Scheduling them in the same wave as the mainstream builds is a reliable way to miss the deadline.

Hybrid deployments hide in a different list

Secure Private Access hybrid deployments that rely on NetScaler instances are explicitly in scope. Ownership of these is often split between a security team and an infrastructure team, which is exactly the configuration in which an appliance gets patched by nobody.

Sequence using the exploitation facts

NCSC-NL reports observed exploitation of CVE-2026-88771 and CVE-2026-88772, both rated 9.5, and states that CVE-2026-88771 affects all deployments with no extra configuration required. Instances reachable from the internet, and those running DTLS on a VPN virtual server, belong at the front of the queue. The smuggling flaw follows immediately behind.

Evidence handling sits inside the change window

Both NCSC-NL and CERT-FR recommend capturing relevant logs and a memory dump before installing the update. For a planned change, that turns a hidden incident-response task into a documented step with a defined owner.

Context from outside

ZoomEye reports 239,194 assets matching app="Citrix NetScaler". It is a global fingerprint count used here to size the population under discussion, not a statement about any individual estate.

References

• Citrix security bulletin CTX697096
• NCSC-NL advisory NCSC-2026-0394
• CERT-FR advisory CERTFR-2026-AVI-1235
• CVE.org record for CVE-2026-88773