Improper Input Validation in Citrix NetScaler ADC and Gateway
CVE-2026-88771

9.5CRITICAL

Key Information:

Vendor

Citrix Netscaler

Status
Adc
Gateway
Vendor
CVE Published:
27 September 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 43,800💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2026-88771?

CVE-2026-88771 represents a significant vulnerability found in Citrix NetScaler ADC and Citrix NetScaler Gateway. These products serve as application delivery controllers and secure remote access gateways, respectively, allowing organizations to manage and optimize application performance while providing secure access for users. The identified vulnerability stems from improper input validation, which can allow unauthenticated attackers to execute arbitrary commands on the affected systems. This could lead to unauthorized access, data leakage, or manipulation of critical application functions, which may severely undermine the security and integrity of organizational networks.

Affected versions include specific releases prior to 14.1-73.37 and 13.1-64.23 for both ADC and Gateway products, posing risks to organizations that maintain outdated software. The presence of this vulnerability without adequate mitigations raises concerns regarding the ability of malicious actors to exploit these systems, potentially leading to extensive security incidents that could disrupt operations.

Potential Impact of CVE-2026-88771

  1. Unauthorized Command Execution: The vulnerability permits attackers to execute arbitrary commands without authentication, which could lead to full system compromise and unauthorized manipulation of sensitive data. This ability to run commands can allow attackers to deploy further malicious payloads or pivot to other parts of the network.

  2. Data Breach Risks: Organizations utilizing affected versions of Citrix NetScaler ADC and Gateway are at an elevated risk for data breaches. If exploited, attackers could gain access to confidential information, including user credentials and sensitive organizational data, leading to significant financial and reputational damage.

  3. Operational Disruption: The exploitation of this vulnerability could result in substantial operational disruptions. Compromised systems may be rendered inoperable, affecting the availability of applications and services that organizations rely on, leading to disruptions in business operations and service delivery to clients.

CISA has reported CVE-2026-88771

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-88771 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

ADC 0 < 14.1-73.37

ADC 0 < 13.1-64.23

ADC 0 < 14.1-73.37 FIPS

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

netscaler_scanner
Created by technion

netscaler_threat_hunt_helper
Created by orjanj

pitscaler
Created by emilstahl

News Articles

favicon imageIt Security News

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - IT Security News

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting...

4 days ago

favicon imageIt Security News

NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - IT Security News

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting...

4 days ago

favicon imageCybersecuritynews

CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely

Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, allowing them to execute code remotely on exposed systems.

1 week ago

References

https://support.citrix.com/support-home/kbsearch/article?...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

  • 📰

    First article discovered by Sdxcentral

.