CVE-2026-88771
Description
CVE-2026-88771 is a critical RCE vulnerability in Citrix NetScaler ADC and Gateway. Actively exploited, it allows unauthenticated command execution.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| netscaler_application_delivery_controller | 13.1 | 13.1-64.23 | vulnerable |
| netscaler_application_delivery_controller | 13.1 | 13.1.37.279 | vulnerable |
| netscaler_application_delivery_controller | 13.1 | 13.1.37.279 | vulnerable |
| netscaler_application_delivery_controller | 14.1 | 14.1-73.37 | vulnerable |
| netscaler_application_delivery_controller | 14.1-66.68 | 14.1-73.37 | vulnerable |
| netscaler_gateway | 13.1 | 13.1-64.23 | vulnerable |
| netscaler_gateway | 14.1 | 14.1-73.37 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest security updates from the Citrix Support portal. Ensure you are following the specific security bulletin instructions for CVE-2026-88771 to address the underlying input validation flaw.
Update affected systems
Upgrade NetScaler ADC and Gateway to versions 14.1-73.37, 13.1-64.23, or later. For FIPS and NDcPP deployments, ensure you move to version 13.1.37.279 or the equivalent patched release for your specific hardware platform.
Restrict access
Minimize the attack surface by restricting access to the NetScaler management interface and ensuring it is not exposed to the public internet. Use firewall rules or ACLs to permit only trusted IP addresses for administrative traffic.
Monitor for exploitation
Conduct forensic triage as directed by CISA BOD 26-04 and Citrix guidance. Check for unusual shell activity, unauthorized configuration changes, or suspicious outbound connections originating from the NetScaler appliance.
Detection Guidance
"To detect potential exploitation of CVE-2026-88771, administrators should monitor NetScaler logs for unusual HTTP requests containing unexpected shell commands or malformed input patterns. Look for suspicious processes spawned by the web server user, such as 'sh' or 'bash'. Additionally, utilize Citrix-provided IOC scanning tools and inspect network traffic for unauthorized outbound connections to known malicious IPs, which may indicate a successful command execution and subsequent beaconing."