Alert GCSA-26236 - Vulnerabilita' critiche in prodotti Citrix

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   Alert ID: GCSA-26236
       Data: 28 settembre 2026
     Titolo: Vulnerabilita' critiche in prodotti Citrix

******************************************************************

:: Descrizione del problema

   Citrix ha rilasciato nuove versioni dei suoi prodotti per risolvere 8 vulnerabilita',
   delle quali 3 sono di livello "critico" e 5 di livello "alto".

   Inoltre le seguenti vulnerabilita' risultano in corso di sfruttamento:

   CVE-2026-88771 (CVSS v4.0 score 9.5) errata convalida di input utente,
   puo' consentire ad un aggressore remoto non autenticato di eseguire comandi arbitrari.

   CVE-2026-88772 (CVSS v4.0 score 9.5) vulnerabilita' di tipo overflow della memoria,
   puo' consentire l'esecuzione di codice remoto o denial of service.

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   NetScaler ADC and  NetScaler Gateway version before 14.1-73.37
   NetScaler ADC and  NetScaler Gateway version before 13.1-64.23

   NetScaler ADC FIPS before 14.1-73.37 FIPS
   NetScaler ADC FIPS and NDcPP before 13.1-37.279


:: Impatto

   Denial of Service (DoS)
   Esecuzione remota di comandi o codice arbitrario (RCE)
   Rivelazione di informazioni (ID)
   Bypass delle funzionalita' di sicurezza (SFB)


:: Soluzioni

   Aggiornare i prodotti alle ultime versioni.

   https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance.html
   https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance/upgrade-standalone-appliance.html
   https://support.citrix.com/external/article/CTX691210/netscaler-upgrades-and-general-configura.html
   https://www.citrix.com/downloads/citrix-adc/

   Steps to Take if NetScaler ADC is Suspected to be Compromised
   https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html


:: Riferimenti

   Citrix Security Bulletin
   https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
   https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

   Bleeping Computer
   https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/

   The Hacker News
   https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html

   Canadian Centre for Cyber Security
   https://www.cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772

   CVE ID
   https://www.cve.org/CVERecord?id=CVE-2026-88771
   https://www.cve.org/CVERecord?id=CVE-2026-88772
   https://www.cve.org/CVERecord?id=CVE-2026-88773
   https://www.cve.org/CVERecord?id=CVE-2026-88774
   https://www.cve.org/CVERecord?id=CVE-2026-88775
   https://www.cve.org/CVERecord?id=CVE-2026-88776
   https://www.cve.org/CVERecord?id=CVE-2026-88777
   https://www.cve.org/CVERecord?id=CVE-2026-88778


GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaro97gAKCRDBnEyTZRJg
QvO9AKCRg5GGRefTojRxYzexYEuXiQv/kwCfQKqArqwNe2THMK0istDpFDofTQg=
=uh4H
-----END PGP SIGNATURE-----