Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-88771 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-27 |
| Vendor | Citrix |
| Product | NetScaler ADC and NetScaler Gateway |
| CVSS Score | 9.5 (critical, CVSS 4.0) |
| EPSS Score | No data |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-30 |
Vulnerability Description
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability (CWE-20) that could allow an unauthenticated attacker to execute arbitrary commands.
The flaw is covered by Citrix bulletin CTX697096, which also addresses CVE-2026-88772 (memory buffer flaw leading to RCE or DoS, also listed in KEV) and further CVEs in the 88773–88778 range.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Fixed versions according to Citrix:
- NetScaler ADC and NetScaler Gateway 14.1 — 14.1-73.37 or later,
- NetScaler ADC and NetScaler Gateway 13.1 — 13.1-64.23 or later,
- NetScaler ADC 14.1 FIPS — 14.1-73.37 FIPS or later,
- NetScaler ADC 13.1 FIPS and NDcPP — 13.1.37.279 or later.
The attack requires no authentication and the vulnerability is actively exploited — after patching, check the appliance for signs of compromise (unknown files, accounts, sessions), as recommended in bulletin CTX697096.
Who Is Affected?
This vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances (physical, virtual and FIPS/NDcPP) running versions older than the fixed builds listed above. NetScaler Gateway is often an internet-facing remote access gateway (VPN, ICA Proxy) — prioritize those instances.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
