CVE-2026-88771: Citrix NetScaler ADC/Gateway Unauthenticated Command Execution (KEV)

CVE-2026-88771 is an improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance, and it is on the CISA Known Exploited Vulnerabilities catalog with a forensic-triage requirement.

CVE-2026-88771 is an Improper Input Validation vulnerability (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer, per the CISA KEV CWE mapping) in Citrix NetScaler ADC and NetScaler Gateway. NVD's own Analyzed description states the flaw affects ADC builds before 14.1-73.37 (standard and FIPS), before 13.1-64.23 (standard), and before 13.1.37.279 (FIPS and NDcPP), and Gateway builds before 14.1-73.37 and before 13.1-64.23, "leading to an unauthenticated attacker to execute arbitrary commands" (NVD).

NVD's own Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no authentication or user interaction required. A separate CNA-submitted CVSS v4.0 Secondary score of 9.5 is also on record (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), but the v3.1 figure above is NVD's own confirmed Primary score (NVD).

CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-27, with a required-action due date of 2026-09-30 and a forensic-triage requirement under BOD 26-04; the catalog notes that "running the provided IOCs in the NetScaler console may help identify indicators of exploitation" and directs customers to Citrix's published mitigation guidance (CISA KEV).

Citrix's own security-bulletin page for this CVE (support.citrix.com, article CTX697096) is a JavaScript application shell that returns no advisory content without executing client-side scripts, so it could not be used as a source for this page; Citrix's companion general-purpose article "Steps to Take if NetScaler ADC is Suspected to be Compromised" (CTX694799) is static and confirms Citrix's standard incident-response guidance — preserving logs and memory/disk images, isolating the appliance, and rotating credentials used on or through it — for any appliance believed to be affected by an exploited NetScaler CVE such as this one (Citrix KB CTX694799).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.8216 (99.653th percentile), consistent with a vulnerability actively being exploited against internet-facing appliances (FIRST EPSS).

Because NVD, CISA KEV and the EPSS percentile all point to confirmed, high-probability exploitation, any NetScaler ADC or Gateway appliance on an affected build should be upgraded immediately and reviewed for compromise using Citrix's incident-response guidance.

• Unauthenticated, remote improper input validation flaw lets an attacker execute arbitrary commands; affects ADC before 14.1-73.37/13.1-64.23/13.1.37.279(FIPS/NDcPP) and Gateway before 14.1-73.37/13.1-64.23. — NVD
• NVD's own Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a separate CNA CVSS v4.0 Secondary score of 9.5 also exists. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-27, required-action due date 2026-09-30, forensic triage required under BOD 26-04; KEV notes recommend checking NetScaler console IOCs. — CISA KEV
• Citrix's CTX697096 bulletin page is a JavaScript-only shell with no readable advisory content; Citrix's CTX694799 article gives general compromise-response steps (log/memory preservation, isolation, credential rotation) applicable to an exploited NetScaler appliance. — Citrix KB CTX694799
• EPSS score is 0.8216 (99.653th percentile) as of 2026-10-27. — FIRST EPSS