Skip to content
Sign in
CVE-2026-887719.5CriticalCWE-20

CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability

Citrix NetScaler · ADC

Vendor fix available · Affected: Citrix NetScaler ADC · Exploitation: in CISA KEV since 27 Sep

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue27 Sep
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public12 public GitHub repositories (unverified), listed by PoC-in-GitHub27 Sep
  5. Not established: not seen
81.9%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

9.5CriticalCVSS 4.0
LowCrit.

Federal deadline

CISA KEV · added 27 Sep · catalogue entry

Passed 41 days ago

DescriptionNVD

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

What changed

  1. PoC-in-GitHub lists 12 public GitHub repositories (unverified) PoC-in-GitHub
  2. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage29 articles · 13 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 27 Sep.

Full timeline
Quiet for 2 weekslast report 27 Oct29 articles13 outlets
27 Sep · SecurityOnline first22 Oct30 OctNow
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.
All coveragerunning total29SecurityOnl…6Security Af…3CISA3SecurityWeek4SOCRadar1Infosecurity1Rapid72NCSC1The Hacker…44 more outlets428 Sep13 Oct28 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
29 articles about CVE-2026-88771 from 13 outlets
Published (UTC)OutletHeadline
27 Sep 18:30SecurityOnlineCitrix NetScaler Zero Days Exploited to Attack VPN Appliances
27 Sep 18:30Security AffairsCitrix NetScaler Zero Days Exploited Against Unpatched Systems
27 Sep 20:47CISACISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action
27 Sep 20:47CISACISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days
27 Sep 23:02CISACISA Warns NetScaler Flaw Is Being Exploited for Command Execution
28 Sep 08:00SecurityWeekCitrix Patches NetScaler Zero Days Exploited in Global Attacks
28 Sep 08:00SOCRadarCitrix Patches NetScaler Zero Days Exploited in Global Attacks
28 Sep 08:35InfosecurityCitrix NetScaler Zero Days Exploited in Attacks, Patch Now
28 Sep 09:47Security AffairsCISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws
28 Sep 12:07Rapid7Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks
28 Sep 13:21NCSCUK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws
28 Sep 14:30The Hacker NewsHackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks
28 Sep 15:30Unit 42Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed
29 Sep 08:00SecurityOnlineCritical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated
30 Sep 07:13The Hacker NewsNetScaler Flaw Exploited to Gain Root Access Before Authentication
30 Sep 08:25Security AffairsCitrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks
30 Sep 10:13The Hacker NewsAttackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells
30 Sep 13:16SecurityWeekCitrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells
1 Oct 02:14SecurityOnlineActive NetScaler Zero Days Expose Devices to Remote Code Execution
1 Oct 04:38The Hacker NewsAttackers Exploit Critical NetScaler Flaw to Steal Configurations
1 Oct 10:28SecurityOnlineCitrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords
1 Oct 12:31DataBreachesCitrix NetScaler Zero Days Exploited Against 50,000 Devices
2 Oct 17:05Dark ReadingCitrix NetScaler Zero Days Exploited as Vendors Take Different Risks
2 Oct 22:22SecurityOnlineCitrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending
5 Oct 05:53SecurityWeekCitrix NetScaler Zero Day Exploited Days After PitScaler Fixes
7 Oct 15:08SecurityOnlineFour attacker groups exploited Citrix NetScaler flaw to gain privileged access
19 Oct 13:24CloudflareCitrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
19 Oct 17:00Rapid7Attackers chained two Citrix NetScaler flaws to gain root access and steal keys
27 Oct 11:55SecurityWeekCitrix patches NetScaler flaws after active exploitation
  1. Citrix patches NetScaler flaws after active exploitation
    SecurityWeek
  2. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys
    Rapid7
  3. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
    Cloudflare
  4. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access
    SecurityOnline
  5. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes
    SecurityWeek · mentions it in passing
  6. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending
    SecurityOnline
  7. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks
    Dark Reading
  8. Citrix NetScaler Zero Days Exploited Against 50,000 Devices
    DataBreaches
Show 21 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in