Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-88771

Published 2026-09-27

Updated 25 days ago

Vendor/s

Citrix

Product/s

NetScaler

Version/s

13.1 > 13.1-64.23

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-88771 is a critical RCE vulnerability in Citrix NetScaler ADC and Gateway. Actively exploited, it allows unauthenticated command execution.

## Why this matters

"CVE-2026-88771 is a critical vulnerability in Citrix NetScaler ADC and Gateway that allows unauthenticated attackers to execute arbitrary commands via the network. With a CVSS score of 9.8, this flaw represents a severe risk to organizational infrastructure, as it requires no user interaction or privileges. Its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog confirms that threat actors are actively targeting this weakness. Successful exploitation grants full control over the appliance, potentially leading to data exfiltration, lateral movement, or complete network compromise. Security teams must prioritize remediation immediately to protect internet-facing gateway services."

## CPE

Citrix

| Product                                      | Version Start | Version End (excl.) | Status     |
| -------------------------------------------- | ------------- | ------------------- | ---------- |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1-64.23          | vulnerable |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1.37.279         | vulnerable |
| netscaler\_application\_delivery\_controller | 13.1          | 13.1.37.279         | vulnerable |
| netscaler\_application\_delivery\_controller | 14.1          | 14.1-73.37          | vulnerable |
| netscaler\_application\_delivery\_controller | 14.1-66.68    | 14.1-73.37          | vulnerable |
| netscaler\_gateway                           | 13.1          | 13.1-64.23          | vulnerable |
| netscaler\_gateway                           | 14.1          | 14.1-73.37          | vulnerable |

## Related weakness (CWE)

CWE-20

## Remediation plan

1

### Apply official patches

Download and install the latest security updates from the Citrix Support portal. Ensure you are following the specific security bulletin instructions for CVE-2026-88771 to address the underlying input validation flaw.

2

### Update affected systems

Upgrade NetScaler ADC and Gateway to versions 14.1-73.37, 13.1-64.23, or later. For FIPS and NDcPP deployments, ensure you move to version 13.1.37.279 or the equivalent patched release for your specific hardware platform.

3

### Restrict access

Minimize the attack surface by restricting access to the NetScaler management interface and ensuring it is not exposed to the public internet. Use firewall rules or ACLs to permit only trusted IP addresses for administrative traffic.

4

### Monitor for exploitation

Conduct forensic triage as directed by CISA BOD 26-04 and Citrix guidance. Check for unusual shell activity, unauthorized configuration changes, or suspicious outbound connections originating from the NetScaler appliance.

## Detection Guidance

"To detect potential exploitation of CVE-2026-88771, administrators should monitor NetScaler logs for unusual HTTP requests containing unexpected shell commands or malformed input patterns. Look for suspicious processes spawned by the web server user, such as 'sh' or 'bash'. Additionally, utilize Citrix-provided IOC scanning tools and inspect network traffic for unauthorized outbound connections to known malicious IPs, which may indicate a successful command execution and subsequent beaconing."

## References

[https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vendor Advisory ](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-88771 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)