NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in docs.netscaler.com/en-us/…/tcp-configurations.html#… looks like this is included the main KB article, not sure if it was added recently (support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix…)

It was included in sec bulletin though could have been clearer (it was only stated as pre-condition for CVE-2026-88778 but not stated as "additional action : new ISN parameter have to be enabled after upgrade"). Also present in CVE reports on NSConsole with remediaton config job template to enable the setting. No adverse effect reported yet on setups I applied the change

ah, so technically not needed after the firmware has been applied, but doens't hurt to have it

Technically NEEDED after upgrade !!! unless mistaken, upgrade creates the parameter but default setting is disabled, you have to Enable it

right, it's a new feature, and only available after the upgrade, ok, got it, thanks for that.

I stand self-corrected after checking a closed lab 14.1-73.33, the parameter is there but DISABLED, so I don't know when it was added

FWIW we had a test, isolated VPX instance that didn't get this enabled after upgrading its firmware and the NS Console CVE checks did flag the missing config. Enabling it cleared the CVE finding.

I have some customers reporting troubles with some URLs transform in the new 13.1 build, did you notice something ?

Good shout - a few of my guys missed it too. Console did the remediation to enable it easily..

Seeing some issues after enabling it on the latest 13.1 firmware, not 100% right now that root cause is enabling it, but timing makes sense, getting a ticket opened on it.