What’s Vulnerable › Vulnerabilities

CVE-2026-88771: A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-09-27
• EPSS: 82.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-27 · updated 2026-09-29
• Weakness: CWE-20

Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Summary

CVE-2026-88771 is a critical improper input validation flaw in Citrix NetScaler ADC and Gateway that allows an unauthenticated attacker to execute arbitrary commands. It affects ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. The vulnerability is actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, with an EPSS 30-day exploitation probability of 82.2%. Apply the fixed versions (13.1-64.23, 13.1.37.279, 14.1-73.37) or follow vendor mitigations and CISA BOD 26-04 guidance, discontinuing use if mitigations are unavailable.

CVE-2026-88771 هو ثغرة حرجة في التحقق من صحة المدخلات في Citrix NetScaler ADC وGateway تسمح لمهاجم غير مصادق عليه بتنفيذ أوامر عشوائية. تؤثر على ADC قبل 14.1-73.37، وقبل 13.1-64.23، وقبل 14.1-73.37 FIPS، وقبل 13.1.37.279 FIPS وNDcPP؛ وGateway قبل 14.1-73.37 وقبل 13.1-64.23. الثغرة مستغلة فعلياً ومدرجة في كتالوج CISA للثغرات المعروفة الاستغلال، مع احتمال استغلال 82.2% خلال 30 يوماً حسب EPSS. طبّق الإصدارات المصححة (13.1-64.23، 13.1.37.279، 14.1-73.37) أو اتبع تخفيفات المورد وإرشادات CISA BOD 26-04، مع إيقاف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Citrix NetScaler ADC: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
• Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1.37.279; from 14.1-66.68 through 14.1-73.37 — fixed in 13.1.37.279
• Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1.37.279 — fixed in 13.1.37.279
• Citrix NetScaler Gateway: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
• NetScaler ADC: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP — fixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP
• NetScaler Gateway: before 14.1-73.37; before 13.1-64.23 — fixed in 14.1-73.37, 13.1-64.23

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-64.23, 14.1-73.37; Citrix Netscaler Application Delivery Controller Fips 13.1.37.279; Citrix Netscaler Application Delivery Controller Ndcpp 13.1.37.279; Citrix NetScaler Gateway 13.1-64.23, 14.1-73.37; NetScaler ADC 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP; NetScaler Gateway 14.1-73.37, 13.1-64.23. Check the vendor advisory for mitigations.

In the news

• This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
• 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
• Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
• Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
• Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

Get alerted when CVE-2026-88771 or the next vulnerability affects your stack