CVE-2026-88771
Citrix NetScaler ADC and Gateway improper input validation allows unauthenticated remote code execution (CVE-2026-88771)
Citrix NetScaler ADC and Gateway have a critical improper input validation flaw permitting unauthenticated remote code execution. CISA's KEV entry lists it as exploited. Apply the fixed versions now; CISA's due date is 30 September 2026.
What happened
An improper input validation weakness in Citrix NetScaler ADC and Citrix NetScaler Gateway allows an unauthenticated attacker to execute arbitrary commands. The vulnerability is reachable over the network and, according to the CVSS 4.0 vector, requires no privileges and no user interaction. Attack complexity is low, although attack requirements are rated present, meaning exploitation requires a specific condition to be met. The CVSS 4.0 base score is 9.5, with high confidentiality, integrity and availability impact on both the affected system and subsequent systems.
CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities Catalog, and CISA's SSVC assessment rates exploitation as active.
Who is affected
Affected products are Citrix NetScaler ADC and Citrix NetScaler Gateway. ADC is affected in releases before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP. Gateway is affected in releases before 14.1-73.37 and before 13.1-64.23. These devices commonly sit at the network edge as application delivery controllers and secure remote-access gateways, terminating external connections, so affected releases should be treated as a high-priority remediation target.
What to do now
- Inventory every NetScaler ADC and Gateway release in use, including FIPS, NDcPP, cloud and virtual appliances.
- Move affected appliances to the fixed versions: ADC 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP; Gateway 14.1-73.37 and 13.1-64.23.
- CISA's required action is to apply mitigations in accordance with vendor instructions and to follow BOD 26-04 guidance; where mitigations are unavailable, CISA advises discontinuing use of the product. Its KEV due date is 30 September 2026.
- If patching cannot be done immediately, remove affected appliances from untrusted networks and restrict access. No workaround has been published.
How to detect it
No specific indicators of compromise are listed in the CVE record or CISA's KEV entry. Because this is a remotely reachable command execution issue, check which NetScaler ADC or Gateway releases are reachable from untrusted networks, and treat unexpected command execution or configuration changes on those appliances as suspicious if observed.
Beyond the patch
Because CISA's KEV entry lists this CVE as exploited, detection and response are the first line while you patch. Managed Detection & Response (MDR) and our Incident Response Retainer support that work. The flaw is reachable over the network without credentials, so Virtual CISO Services can help identify and reduce exposed NetScaler footprints before the next advisory lands.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| ADC | – < 14.1-73.37 – < 13.1-64.23 – < 14.1-73.37 FIPS – < 13.1.37.279 FIPS and NDcPP | 14.1-73.37 13.1-64.23 14.1-73.37 FIPS 13.1.37.279 FIPS and NDcPP |
| Gateway | – < 14.1-73.37 – < 13.1-64.23 | 14.1-73.37 13.1-64.23 |