CVE-2026-88771
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
CISA Known Exploited Vulnerability
Vendor / Product
Citrix — NetScaler
Date Added
2026-09-27
Remediation Due
2026-09-30
Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772
Weakness Classification (1)
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1-64.23 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | 14.1 – 14.1-73.37 |
| citrix | netscaler_application_delivery_controller | 14.1-66.68 – 14.1-73.37 |
| citrix | netscaler_gateway | 13.1 – 13.1-64.23 |
| citrix | netscaler_gateway | 14.1 – 14.1-73.37 |
References & Advisories (2)
Vendor Advisory
US Government Resource