CriticalCVE-2026-88771

Citrix NetScaler Improper Input Validation Vulnerability (CVE-2026-88771)

Published 27.09.2026Last modified 29.09.2026In CISA KEV since 27.09.2026Sources: CVE.org, SingCERT, NCSC UK, ASD ACSC, NCSC NZ, CERT-EU, pwn.watch, BSI

Actively exploited
Source: VulnCheck KEV (opens in a new tab), ASD ACSC, CERT.at, ANSSI / CERT-FR, CIRCL KEV, JPCERT/CC, NCSC NZ, NCSC UK, CSA/SingCERT How we classify
Public exploit

What is affected, what to do

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

The vulnerability is being actively exploited; treat it as a priority. Update Citrix NetScaler ADC to version 14.1-73.37, Citrix NetScaler ADC to version 13.1-64.23, Citrix NetScaler Gateway to version 14.1-73.37. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: Citrix NetScaler ADC lt *..14.1-73.37
Citrix NetScaler ADC lt *..13.1-64.23
Citrix NetScaler Gateway lt *..14.1-73.37
Citrix NetScaler Gateway lt *..13.1-64.23
Fixed in: Citrix NetScaler ADC 14.1-73.37
Citrix NetScaler ADC 13.1-64.23
Citrix NetScaler Gateway 14.1-73.37
Citrix NetScaler Gateway 13.1-64.23

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

9.8

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

9.8

CVSS v3

Severity Critical on the scale from 0 to 10.

Source: CVE.org, SingCERT, NCSC UK, ASD ACSC, NCSC NZ, CERT-EU, pwn.watch, BSI

82.2 %

EPSS score

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Source: FIRST EPSS, percentile 99.65

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 258.05 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploitedSource: VulnCheck KEV (opens in a new tab), ASD ACSC, CERT.at, ANSSI / CERT-FR, CIRCL KEV, JPCERT/CC, NCSC NZ, NCSC UK, CSA/SingCERT How we classify
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 9.8 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 9.8
CVSS v4 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 9.5
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 82.2 %; High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 99.65; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 27.09.2026
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 27.09.2026
CISA assessment (SSVC): Exploitation: active · automatable · Technical impact: total; Source: CISA Vulnrichment, as of 27 September 2026
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-20

Response and mitigation

Why act now?

Prioritisation rationale

NetScaler ADC and Gateway sit on the perimeter as the remote-access and load-balancing tier. Network-reachable command execution without authentication or user interaction therefore means full takeover of a box that holds credentials, live sessions and a path into the internal network. EPSS currently models only a moderate exploitation likelihood, but KEV inclusion confirms real-world attacks, and NetScaler flaws have historically been mass-scanned quickly and used for webshell persistence. Treat internet-facing instances as top priority: patch within 24 h and run a compromise assessment. CISA does not flag ransomware use, but that should not lower urgency for exposed systems. Purely internal instances with no reachable management or Gateway interface can follow in the regular emergency patch window.

01
Runbook step 1
Immediate response (0-24 h)
- Inventory: Enumerate every NetScaler ADC and NetScaler Gateway instance (MPX, VPX, SDX guests, cloud marketplace) and record firmware via show ns version. Affected are builds before 14.1-73.37 and 13.1-64.23, plus FIPS/NDcPP builds before 13.1-37.279 (listed in the context as "13.1.37.279") and 14.1-73.37 FIPS.
- Patch: Upgrade internet-facing Gateway and ADC appliances first to 14.1-73.37 or 13.1-64.23. Move FIPS/NDcPP systems to 13.1-37.279 or 14.1-73.37 FIPS. For HA pairs, upgrade the secondary first, then fail over.
- Preserve evidence: Patching does not remove implanted persistence. Before upgrading, image or copy /var/log/, /var/nslog/ and the web roots so you can run a compromise assessment.
- Terminate sessions: After upgrading, run kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all and clear lb persistentSessions.
- Rotate credentials: If compromise is suspected, rotate nsroot, local admin accounts, LDAP/RADIUS bind accounts, service credentials stored in ns.conf, and TLS private keys.
- Reporting: Check NIS2 reporting duties if compromise is confirmed. An early warning to the national CSIRT/authority is due within 24 h.
02
Runbook step 2
Mitigation layers
- Network segmentation: Restrict management interfaces (NSIP, and any SNIP with management access enabled) to a dedicated admin VLAN or jump host. Block TCP 22/80/443/3010/3008 from everywhere else on the upstream firewall.
- Attack surface: The context does not specify the entry vector, so treat every externally reachable vServer (Gateway, AAA, LB with GUI) as exposed. Disable unused vServers and temporarily restrict Gateway access by geo or IP allowlist.
- Egress filtering: Allow outbound traffic from the appliance only to known destinations (DNS, NTP, syslog, auth backends). Default-deny egress breaks payload staging and reverse shells.
- IPS/WAF: Enable vendor IPS signatures for CVE-2026-88771 (Suricata ET, Palo Alto, Fortinet) as soon as they ship. Until then, log and review requests to /vpn/, /oauth/, /cgi/ and /nf/auth/ that carry oversized headers or parameters, or shell metacharacters (;, |, $(, backticks).
- IAM/least privilege: Require centralised admin authentication with MFA. Keep nsroot as a break-glass account only, with a strong vaulted password.
- Lifecycle: Identify any release lines that are out of vendor support and plan migration, as no fix should be expected for them.
03
Runbook step 3
Detection rules
- Process ancestry (shell logs / ps): Treat sh, bash, curl, python, perl, nc or openssl spawned by httpd or nsppe as user nobody as high-fidelity. Sigma shape: ParentImage|endswith: '/httpd' AND Image|endswith: ['/sh','/bash','/curl','/python'].
- File integrity: Hunt for new or modified files in /netscaler/ns_gui/, /var/netscaler/logon/, /var/vpn/ and /var/python/, e.g. find /netscaler/ns_gui /var/netscaler/logon /var/vpn -type f $ -name "*.php" -o -name "*.sh" -o -name "*.xhtml" $ -mtime -30. Also review crontab, /etc/rc.netscaler and /nsconfig/rc.netscaler for unexpected entries.
- Web logs: Search /var/log/httpaccess.log and ns.log for requests containing shell metacharacters or Base64 blobs, and for hits on newly dropped .php files. SPL: index=netscaler sourcetype=citrix:httpaccess uri="*.php" status=200 | stats count by src_ip uri.
- Network telemetry (Zeek/Suricata): Flag outbound connections from NSIP/SNIP to unknown external IPs, especially on unusual ports or with long durations (reverse shell). In Zeek conn.log: id.orig_h in netscaler_ips and not id.resp_h in allowlist.
- Crash indicators: Repeated nsppe core dumps in /var/core/ or /var/crash/ may indicate failed exploitation attempts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

1 request for a rule for this vulnerability.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT, NCSC UK (OGL v3.0), ASD ACSC (CC BY 4.0), cvelistv5, NCSC NZ (CC BY 4.0), certeu_advisory, pwn.watch, BSI WID Portal, BSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Citrix NetScaler	ADC	`< 14.1-73.37` `< 13.1-64.23`	`14.1-73.37` `13.1-64.23`
Citrix NetScaler	Gateway	`< 14.1-73.37` `< 13.1-64.23`	`14.1-73.37` `13.1-64.23`
citrix	netscaler_application_delivery_controller	`13.1 – < 13.1-64.23` `14.1-66.68 – ≤ 14.1-73.37` `14.1 – < 14.1-73.37` `13.1 – < 13.1.37.279`	`13.1-64.23` — `14.1-73.37` `13.1.37.279`
citrix	netscaler_gateway	`14.1 – < 14.1-73.37` `13.1 – < 13.1-64.23`	`14.1-73.37` `13.1-64.23`
Citrix Systems	NetScaler ADC	`< 14.1-73.37` `< 13.1-64.23`	`14.1-73.37` `13.1-64.23`
Citrix Systems	NetScaler ADC FIPS	`< 13.1-37.279` `< 14.1-73.37`	`13.1-37.279` `14.1-73.37`
Citrix Systems	NetScaler ADC NDcPP	`< 13.1-37.279`	`13.1-37.279`
Citrix Systems	NetScaler Gateway	`< 13.1-64.23` `< 14.1-73.37`	`13.1-64.23` `14.1-73.37`

Vendors and products

Weakness classes (CWE)

CWE-20Improper Input Validation
Class
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Entry at MITRE CWE-20

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	27.09.2026
CSA/SingCERT	Active Exploitation of Vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway (opens in a new tab)CSA/SingCERT	actively exploited	27.09.2026
NCSC UK	Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway (opens in a new tab)NCSC UK	actively exploited	28.09.2026
ASD ACSC	Critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway products (opens in a new tab)ASD ACSC	actively exploited	01.10.2026
NCSC NZ	UPDATED: Multiple vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway products (opens in a new tab)NCSC NZ	actively exploited	13.10.2026
ANSSI / CERT-FRLicence Ouverte 2.0, as of 05.10.2026	CERTFR-2026-ALE-011 – Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (opens in a new tab)cert.cyber.gouv.fr	actively exploited	28.09.2026
CIRCL KEV	vulnerability.circl.lu (opens in a new tab)	actively exploited	28.09.2026
CIRCL Sightings	labs.watchtowr.com (opens in a new tab)	PoC (publicly reported)reported, not verified	28.09.2026
PoC-in-GitHub (nomi-sec)	netscaler-defensive-checker (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	08.10.2026
PoC-in-GitHub (nomi-sec)	netscaler_threat_hunt_helper (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	02.10.2026
PoC-in-GitHub (nomi-sec)	pitscaler (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	01.10.2026
PoC-in-GitHub (nomi-sec)	NetScaler-CTX697096-Assessment-Script (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	01.10.2026
PoC-in-GitHub (nomi-sec)	CVE-2026-88771-HuntScript (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	29.09.2026
PoC-in-GitHub (nomi-sec)	netscaler-ctx697096-checker (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	28.09.2026
PoC-in-GitHub (nomi-sec)	citrix-netscaler-cve-2026-88771-rce (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	28.09.2026
PoC-in-GitHub (nomi-sec)	CVE-2026-88771-POC (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	28.09.2026
PoC-in-GitHub (nomi-sec)	netscaler_scanner (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	28.09.2026

References & sources

support.citrix.comsupport-home/kbsearch/article?articleNumber=CTX697096
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771government-resource
cert.atCERT.at: Kritische Sicherheitslücken in Citrix NetScaler ADC und NetScaler Gateway - aktiv ausgenutzt - Updates verfügbarcert-at
cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2026-ALE-011 – Multiples vulnérabilités dans Citrix NetScaler ADC et Gatewaycert-fr
pwn.watchpwn.watch: Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772)pwn-watch
support.citrix.comCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (CTX697096)pwn-watch
support.citrix.comCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406 (CTX697191)pwn-watch
cisa.govCritical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gatewaypwn-watch
cyber.gc.caAL26-024: Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gatewaypwn-watch
cert.europa.euCERT-EU 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gatewaypwn-watch
rapid7.comRapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779pwn-watch
cybersecuritytimes.comZscaler Detects Coordinated Exploitation Attempts Targeting Critical NetScaler RCE Flawpwn-watch
JPCERT/CCJPCERT/CC JPCERT-AT-2026-0029: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起jpcert

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

29.09.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: yes

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
SSVC assessment	removed	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T12:43:00.920024Z"}	—
SSVC assessment	added	—	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T00:00:00+00:00"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

28.09.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: yes

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
SSVC assessment	removed	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T00:00:00+00:00"}	—
SSVC assessment	added	—	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T12:43:00.920024Z"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

28.09.2026Initial analysis by NVDNVD

Newly listed as affected:

Citrix NetScaler Application Delivery Controller (ADC) (13.1 – before 13.1-64.23; 14.1 – before 14.1-73.37; 13.1 – before 13.1.37.279; 14.1-66.68 – through 14.1-73.37)
Citrix NetScaler Gateway (13.1 – before 13.1-64.23; 14.1 – before 14.1-73.37)

CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

New references:

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Product configuration	added	—	OR cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-::: versions from (including) 13.1 up to (excluding) 13.1-64.23 cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-::: versions from (including) 14.1 up to (excluding) 14.1-73.37 cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips::: versions from (including) 13.1 up to (excluding) 13.1.37.279 cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips::: versions from (including) 14.1-66.68 up to (including) 14.1-73.37 cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp::: versions from (including) 13.1 up to (excluding) 13.1.37.279 cpe:2.3:a:citrix:netscaler_gateway::::::::* versions from (including) 13.1 up to (excluding) 13.1-64.23 cpe:2.3:a:citrix:netscaler_gateway::::::::* versions from (including) 14.1 up to (excluding) 14.1-73.37
Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771 Types: US Government Resource
Reference type	added	—	NetScaler: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Types: Vendor Advisory

Source identifier: nvd@nist.gov

28.09.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: no

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
SSVC assessment	removed	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T22:01:35.729666Z"}	—
SSVC assessment	added	—	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T00:00:00+00:00"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

27.09.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: yes

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
SSVC assessment	removed	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T19:57:06.610147Z"}	—
SSVC assessment	added	—	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T22:01:35.729666Z"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Show 3 older changes

27.09.2026CISA KEV entry updated9119a7d8…
4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name
Show 4 original changes
Individual changes of this event as published by NVD
Type Action Before After
Date Added added
—
2026-09-27
Due Date added
—
2026-09-27
Required Action added
—
2026-09-27
Vulnerability Name added
—
2026-09-27
Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

Individual changes of this event as published by NVD
Type	Action	Before	After
Date Added	added	—	2026-09-27
Due Date	added	—	2026-09-27
Required Action	added	—	2026-09-27
Vulnerability Name	added	—	2026-09-27

27.09.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: yes

New references:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771
SSVC assessment	added	—	{"id":"CVE-2026-88771","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-27T19:57:06.610147Z"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

27.09.2026Received50a63c94…

CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Weakness type: CWE-20

Description added or changed

New references:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Show 5 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Description	added	—	Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
CVSS	added	—	AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness type (CWE)	added	—	CWE-20
Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/88xxx/CVE-2026-88771.json">CVE-2026-88771</a>
Reference	added	—	https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Source identifier: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

One NVD translation into another language is hidden.

Linked advisories

Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day AttacksSecurityWeek30.09.2026
NCSC-2026-0394 [1.01] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler GatewayNCSC-NL30.09.2026
NetScaler admins told to patch critical zero-days in ADC and Gateway nowCSO Online28.09.2026
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the PlugSecurityWeek28.09.2026
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws GloballyThe Hacker News28.09.2026
Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre 2026)CERT-FR (ANSSI)28.09.2026
NCSC-2026-0394 [1.00] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler GatewayNCSC-NL27.09.2026
Citrix confirms two NetScaler RCE zero-days exploited in attacksBleepingComputer27.09.2026

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2026-88771"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-88771.svg?lang=en" alt="CVE-2026-88771 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Weakness classes (CWE)

Public exploit references

References & sources

Changes to this CVE

Linked advisories