CVE-2026-88771 - Vulnerability Details

- A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Published: 2026-09-27

Score: 9.5 Critical

EPSS: 81.9% High

KEV: Yes

Impact:

Action:

Analysis

Impact

Improper input validation in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to construct malicious input that bypasses security checks and executes arbitrary commands on the underlying host. This flaw is classified as a Remote Code Execution vulnerability.

Affected Systems

Affected systems include Citrix NetScaler ADC versions prior to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS and NDcPP, as well as Citrix NetScaler Gateway versions before 14.1-73.37 and 13.1-64.23. All firmware revisions listed are impacted and require update or mitigation.

Risk and Exploitability

The CVSS score of 9.5 signals a critical severity, and an EPSS score of 82% indicates a high likelihood of real‑world exploitation. The vulnerability is listed in the CISA KEV catalog, confirming that exploitation has been documented. Based on the description, it is inferred that the flaw can be exploited remotely over the network by sending crafted requests with no authentication required. This combination of high severity and broad availability makes timely remediation essential.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Citrix NetScaler

ADC

unaffected

Version	Status	Constraints
`0`	affected	< 14.1-73.37
`0`	affected	< 13.1-64.23
`0`	affected	< 14.1-73.37 FIPS
`0`	affected	< 13.1.37.279 FIPS and NDcPP

Citrix NetScaler

Gateway

unaffected

Version	Status	Constraints
`0`	affected	< 14.1-73.37
`0`	affected	< 13.1-64.23

Configuration 1 [-]

OR	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_gateway::::::::
	cpe:2.3:a:citrix:netscaler_gateway::::::::

No data.

Vendor Product Confidence Versions

Citrix

Netscaler Adc

100%

Version	Status	Scheme	Platform
`[0,14.1-73.37)`	affected	generic	—
`[0,13.1-64.23)`	affected	generic	—
`[0,14.1-73.37 FIPS)`	affected	generic	—
`[0,13.1.37.279 FIPS and NDcPP)`	affected	generic	—

Citrix

Netscaler Gateway

100%

Version	Status	Scheme	Platform
`[0,14.1-73.37)`	affected	generic	—
`[0,13.1-64.23)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Ensure the device firmware is updated to a version that resolves the vulnerability; if no patch is available, proceed with the next steps.
Restrict management interface access to trusted IP ranges only, block unused management ports, or place the device behind a dedicated firewall or DMZ to prevent unauthenticated access.
Segment the network so only trusted hosts can reach the ADC/Gateway, and monitor for suspicious traffic.

Generated by OpenCVE AI on November 5, 2026 at 14:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Sept. 27, 2026.

The EPSS score is 0.81894.

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

History

Mon, 28 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Citrix netscaler Adc
Vendors & Products		Citrix netscaler Adc

Mon, 28 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Citrix Citrix netscaler Application Delivery Controller Citrix netscaler Gateway
CPEs		cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::* cpe:2.3:a:citrix:netscaler_gateway::::::::
Vendors & Products		Citrix Citrix netscaler Application Delivery Controller Citrix netscaler Gateway
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 27 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-09-27T00:00:00+00:00', 'dueDate': '2026-09-30T00:00:00+00:00'}`

Sun, 27 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 27 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Title		A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Weaknesses		CWE-20
References		https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Metrics		cvssV4_0 `{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

Subscriptions

Citrix Netscaler Adc Netscaler Application Delivery Controller Netscaler Gateway

MITRE

Status: PUBLISHED

Assigner: NetScaler

Published: 2026-09-27T16:02:07.001Z

Updated: 2026-09-29T03:55:15.090Z

Reserved: 2026-09-10T07:14:57.369Z

Link: CVE-2026-88771

Vulnrichment

Updated: 2026-09-27T17:39:21.929Z

NVD

Status : Analyzed

Published: 2026-09-27T17:16:56.260

Modified: 2026-09-29T04:18:01.603

Link: CVE-2026-88771

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-05T15:00:19Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation active

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object