Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-88771: Citrix NetScaler lets attackers run commands remotely

CVE-2026-88771 · published 22 days ago · actively exploited

Summary

The NetScaler ADC and NetScaler Gateway can be tricked into accepting harmful input, letting anyone on the network execute commands on the device. This could give an attacker control over the load balancer or VPN gateway, potentially exposing internal systems. Apply the latest vendor patches and limit network access to these appliances as soon as possible.

What to do

Update citrix netscaler adc to version 14.1-73.37 or later.
Update citrix netscaler gateway to version 14.1-73.37 or later.

Affected software

Vendor	Product	Affected versions
citrix	netscaler	All versions
citrix netscaler	adc	< 14.1-73.37
citrix netscaler	gateway	< 14.1-73.37
citrix	netscaler_application_delivery_controller	>= 13.1, < 13.1-64.23 >= 13.1, < 13.1.37.279 >= 14.1, < 14.1-73.37 >= 14.1-66.68, <= 14.1-73.37 `cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*`
citrix	netscaler_gateway	>= 13.1, < 13.1-64.23 >= 14.1, < 14.1-73.37 `cpe:2.3:a:citrix:netscaler_gateway::::::::`

Original advisory text

Citrix NetScaler Improper Input Validation Vulnerability

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 3 days

and check for signs of compromise

Known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.5 Critical

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published27 Sep 2026

Updated19 Oct 2026

First seen27 Sep 2026

Sources

CVE-2026-88771 · NVD

CVE-2026-88771 · MITRE

CVE-2026-88771 · CISA KEV

Track software like this

Free during beta