home / blog
2026-10-31 · critical
CVE-2026-88771: Critical RCE in Citrix NetScaler
Critical RCE (CVSS 9.8) in Citrix NetScaler ADC and Gateway due to improper input validation. Patches available.
CVE-2026-88771 is an improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that allows unauthenticated users to execute arbitrary commands with system privileges. It directly impacts critical appliances managing remote access and load balancing across thousands of global enterprises, representing risk of total network infrastructure compromise.
The CVSS score is 9.8 critical, with maximum impact on confidentiality, integrity, and availability. The vulnerability was published to NVD on September 27, 2026. Official patches are available from Citrix for specified versions. Unverified social media posts describe this flaw as among the most exploited currently, a signal that amplifies response urgency, though not an official verified finding.
Highest priority for sysadmins and infrastructure teams: execute complete inventory of NetScaler in production, verify versions against Citrix advisories, update immediately to patched builds, implement monitoring on unauthenticated administrative service access attempts. The CVSS 9.8 rating with unauthenticated RCE admits no delays: every hour of inaction fully exposes your network to compromise.
At a glance
- What
- Improper input validation in Citrix NetScaler ADC and NetScaler Gateway allows arbitrary command execution (RCE) by unauthenticated attacker via CVE-2026-88771.
- Severity
- CVSS 9.8 critical. Unauthenticated attacker can execute arbitrary commands with system privileges directly on critical appliances.
- Affected versions
- ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, before 13.1.37.279 FIPS and NDcPP. Gateway: before 14.1-73.37 and before 13.1-64.23.
- Fix
- Update to indicated patched versions: ADC 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS, 13.1.37.279 FIPS. Gateway 14.1-73.37 or 13.1-64.23 or later.
- Status
- Published to NVD on September 27, 2026. Official patches available from Citrix. Unverified social media posts describe this as among the most exploited vulnerabilities this week.
- Action
- Immediate inventory of all production NetScaler instances with version details. Plan priority upgrade. Monitor unauthenticated access to administrative interfaces and APIs.
Sources: NVD, CVE-2026-88771