Citrix confirms attacks against CVE-2026-88771 and CVE-2026-88772. The first affects default configurations; the second requires DTLS, which is enabled by default on VPN virtual servers. This is an earlier disclosure still requiring action, not a new October 23 vulnerability.
Affected systems and fixes
Product
Affected
Fixed release / action
ADC / Gateway 14.1
Before 14.1-73.37
14.1-73.37
ADC / Gateway 13.1
Before 13.1-64.23
13.1-64.23
14.1 FIPS
Before the listed fixed build
14.1-73.37 FIPS
13.1 FIPS / NDcPP
Before the listed fixed build
13.1.37.279
Confirm the running version against the vendor advisory, including any distribution backports.
CISA exploitation evidence
Catalog 2026.10.23 · Checked Oct 24, 2026 UTC
CISA lists these CVEs in its Known Exploited Vulnerabilities catalog. This confirms known exploitation, not compromise of your environment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Citrix
Response checklist
0 of 3 complete
Sources
Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.