CVE intelligenceCISA KEV

CVE-2026-88771

Citrix NetScaler Improper Input Validation Vulnerability

Published Sep 27, 2026Sources checked Nov 12, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-88771 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Citrix NetScaler.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploit: Cataloged public exploit.

Citrix Security Bulletins: Exploitation reported by Citrix Security Bulletins (2026-10-12)
Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.
Rapid7 Research: Exploitation reported by Rapid7 Research (2026-09-28)
Rapid7 reports exploitation of CVE-2026-88771 and CVE-2026-88772 and adds CVE-2026-88779 in its October 5 update. Its table does not report exploitation for CVE-2026-88773 through CVE-2026-88778.
Citrix: Citrix publishes fixed builds and configuration prerequisites (2026-09-27)
Citrix lists fixed releases for customer-managed NetScaler ADC and Gateway. This affects customer-managed NetScaler ADC and Gateway, including default configurations; no additional feature needs to be enabled.
The Hacker News: Updated reporting confirms Citrix fixes are available (2026-09-27)
The updated article cites Citrix on exploitation of CVE-2026-88771 and CVE-2026-88772 and available fixes. Its earlier unpatched headline predates the bulletin. This covers the same vendor statement, not an independent detection, and links Citrix guidance for suspected compromise.
GreyNoise: Pre-disclosure exploitation attempt targets hidden web shell (2026-09-28)
GreyNoise records a September 24 CVE-2026-88771 attempt to install .ctxs.receiver, change web-server aliases and elevate shell permissions. Its sensor did not suffer a successful foothold. This is separate from the CVE-2026-88772 intrusions described by Mandiant.
Rapid7 Metasploit: Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771) (2026-10-23 00:44:03.604174+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

What to do next

Remediation and response

Upgrade to the fixed build for your branch: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP, or a later release listed by Citrix.
This affects customer-managed NetScaler ADC and Gateway, including default configurations; no additional feature needs to be enabled.
If compromise is suspected, preserve evidence and follow Citrix article CTX694799 for isolation, credential rotation and recovery. Patching alone does not rule out earlier compromise.
For 13.1 upgrades, check configured variables before selecting 13.1-64.23; Citrix recommends 13.1-64.24 for that configuration to avoid cyclic reboots. Validate signed SAML assertions after upgrading.

Citrix Security Bulletins guidance

Vendor revision: Oct 12, 2026

Vendor remediation details

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1 Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation

Vendor-listed releases

Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP

CISA KEVListedObserved exploitation

EPSS81.9%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2026-88771?

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Source: NVD

Vendor context: Citrix lists fixed releases for customer-managed NetScaler ADC and Gateway. This affects customer-managed NetScaler ADC and Gateway, including default configurations; no additional feature needs to be enabled.
Citrix · Published Sep 27, 2026
Reported activity: Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.
Citrix Security Bulletins · Published Oct 12, 2026

CISA says:Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA catalog due date Sep 30, 2026