{"id":"CVE-2026-88771","title":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…","summary":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-20"],"vendor":"citrix","product":"netscaler_application_delivery_controller","affected":["netscaler_application_delivery_controller >= 13.1, < 13.1-64.23","netscaler_application_delivery_controller >= 13.1, < 13.1.37.279","netscaler_application_delivery_controller >= 14.1, < 14.1-73.37","netscaler_application_delivery_controller >= 14.1-66.68, <= 14.1-73.37","netscaler_gateway >= 13.1, < 13.1-64.23","netscaler_gateway >= 14.1, < 14.1-73.37"],"patched":["netscaler_application_delivery_controller 14.1-73.37","netscaler_gateway 14.1-73.37"],"published":"2026-09-27","updated":"2026-09-29","sourceUpdated":"2026-09-29T04:18:01.603","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","label":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-27T22:01:35.729666Z"},"scores":{"nvd":9.8,"cna":9.5},"kev":true,"kevDateAdded":"2026-09-27","kevDueDate":"2026-09-30","kevRansomware":false,"exploits":{"github":12,"githubRepos":["https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","https://github.com/technion/netscaler_scanner"],"metasploit":["exploit/freebsd/http/citrix_netscaler_cve_2026_88771"],"checkedAt":"2026-10-27T19:20:12.447Z"},"zeroDay":true,"ingestedAt":"2026-09-27T16:55:23.216Z","epss":0.8216,"epssPercentile":0.99653,"slug":"CVE-2026-88771","body":"## Overview\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.\n\n## Affected\n\n- `netscaler_application_delivery_controller >= 13.1, < 13.1-64.23`\n- `netscaler_application_delivery_controller >= 13.1, < 13.1.37.279`\n- `netscaler_application_delivery_controller >= 14.1, < 14.1-73.37`\n- `netscaler_application_delivery_controller >= 14.1-66.68, <= 14.1-73.37`\n- `netscaler_gateway >= 13.1, < 13.1-64.23`\n- `netscaler_gateway >= 14.1, < 14.1-73.37`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `netscaler_application_delivery_controller 14.1-73.37`\n- `netscaler_gateway 14.1-73.37`","depth":"hadal","depthScore":95,"depthScoreParts":{"impact":53.9,"likelihood":16.4,"exploitation":25,"ransomware":0},"changes":[{"seq":230243,"id":"CVE-2026-88771","ts":1793128820600,"field":"epss","old":"0.05108","new":"0.8216"},{"seq":211937,"id":"CVE-2026-88771","ts":1790604779368,"field":"cvss","old":"9.5","new":"9.8"},{"seq":211926,"id":"CVE-2026-88771","ts":1790602907008,"field":"cvss","old":"9.8","new":"9.5"},{"seq":211883,"id":"CVE-2026-88771","ts":1790601035497,"field":"cvss","old":"9.5","new":"9.8"},{"seq":211713,"id":"CVE-2026-88771","ts":1790553631463,"field":"zero_day","old":"false","new":"true"},{"seq":211712,"id":"CVE-2026-88771","ts":1790553631463,"field":"kev","old":"false","new":"true"},{"seq":211681,"id":"CVE-2026-88771","ts":1790542715211,"field":"exploit_available","old":"false","new":"true"},{"seq":211680,"id":"CVE-2026-88771","ts":1790542715211,"field":"exploited","old":"false","new":"true"}]}