CVE-2026-88771

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-88771

Citrix · NetScaler · Added 2026-09-27 · Published 2026-09-27

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCitrix NetScaler Improper Input Validation Vulnerability

VendorCitrix

ProductNetScaler

Date added2026-09-27

Due date2026-09-30

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-20

Descriptions

KEV: Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

NVD: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-27 22:20 UTC

Wall time0.6s

Searches9

Component defaultyes

Sources https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
https://advisories.ncsc.nl/2026/ncsc-2026-0394.html
https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://nvd.nist.gov/vuln/detail/CVE-2026-88771
https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html
https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
https://securityaffairs.com/199873/security/citrix-confirmed-two-new-netscaler-flaws-exploited-as-zero-day.html
https://decipher.sc/2026/09/27/researchers-warn-of-citrix-netscaler-exploitation/
https://www.cyberkendra.com/2026/09/cve-2026-88771-netscaler-zero-days-exploited.html

Hunting hypothesis agent

Hunt NetScaler syslog and HTTP transaction logs for unauthenticated requests hitting the ADC/Gateway request-handling path triggering command execution on builds before 14.1-73.37 or 13.1-64.23, and NetScaler Console file integrity alerts.

Research details

ComponentADC/Gateway core unauthenticated request-handling path (reachable on all deployments; no feature or virtual-server configuration required)

PreconditionsNo authentication, user interaction, or special configuration required: the flaw is reachable pre-auth over the network on every ADC and Gateway deployment, including default configurations. Affected builds: 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1 before 14.1-73.37 FIPS, and 13.1 before 13.1-37.279 FIPS/NDcPP; Secure Private Access Hybrid deployments using NetScaler instances are also affected. agent

Deliveryunauthenticated network requests to ADC/Gateway (no feature or configuration required)

Public PoCno

Advisoryhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Exploit notesCVSS v4 base 9.5 (AV:N/AC:L/PR:N/UI:N) — unauthenticated network exploitation with low complexity, and Citrix states no additional feature or configuration is needed, so every vulnerable build is directly exposed. No public PoC, Nuclei template, or technical exploit write-up was found in this research cycle (GitHub repository/code searches returned only CVE mirrors and news digests); the flaw was surfaced by watchTowr from forensic investigations and exploited as a zero-day before the 2026-09-27 bulletin, so request-level observables remain unpublished. Citrix publishes generic IoCs through the Security Advisory scan in NetScaler Console 14.1-73.36+ with the telemetry channel enabled, and warns they may not cover every attacker technique.

SummaryCVE-2026-88771 is a critical (CVSS v4 9.5) improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker execute arbitrary commands. Citrix states all ADC and Gateway deployments are affected — 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, ADC 14.1 before 14.1-73.37 FIPS, and ADC 13.1 before 13.1-37.279 FIPS/NDcPP — with no feature or configuration required. The flaw was exploited as a zero-day before the 2026-09-27 bulletin CTX697096, is confirmed exploited in the wild, and no public PoC is known.

Tia coverage

First reported2025-08-26

First exploit report2026-09-27

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

citrix-netscaler-unpatched-rce-zero-days september-2026-cve-landscape

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.