{"id":"CVE-2026-88771","aliases":["EUVD-2026-87958","GHSA-mx58-p288-86qp"],"status":"published","title":"A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands","description":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.81894,"percentile":0.99654,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-20"],"published":"2026-09-27T16:02:07Z","modified":"2026-09-29T04:18:01Z","kev":{"date_added":"2026-09-27","due_date":"2026-09-30","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-09-27"},{"source":"kev","since":"2026-09-27"}],"exploits":[{"source":"metasploit","id":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","title":"Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","type":"exploit","platform":"Unix","date":"2026-09-27","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/freebsd/http/citrix_netscaler_cve_2026_88771"},{"source":"pocgithub","id":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","title":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","date":"2026-09-27","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771"},{"source":"pocgithub","id":"ThomasPoppelgaard/netscaler-ctx697096-checker","title":"ThomasPoppelgaard/netscaler-ctx697096-checker","date":"2026-09-28","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker"},{"source":"pocgithub","id":"craigsblackie/cve-2026-88771-netscaler","title":"craigsblackie/cve-2026-88771-netscaler","date":"2026-09-28","url":"https://github.com/craigsblackie/cve-2026-88771-netscaler"},{"source":"pocgithub","id":"technion/netscaler_scanner","title":"technion/netscaler_scanner","date":"2026-09-28","url":"https://github.com/technion/netscaler_scanner"},{"source":"pocgithub","id":"techupdate24/citrix-netscaler-cve-2026-88771-rce","title":"techupdate24/citrix-netscaler-cve-2026-88771-rce","date":"2026-09-28","url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-88771-rce"},{"source":"pocgithub","id":"SwiftSecur/CVE-2026-88771-HuntScript","title":"SwiftSecur/CVE-2026-88771-HuntScript","date":"2026-09-29","url":"https://github.com/SwiftSecur/CVE-2026-88771-HuntScript"},{"source":"pocgithub","id":"bkchaudhari/NetScaler-CTX697096-Assessment-Script","title":"bkchaudhari/NetScaler-CTX697096-Assessment-Script","date":"2026-10-01","url":"https://github.com/bkchaudhari/NetScaler-CTX697096-Assessment-Script"},{"source":"pocgithub","id":"emilstahl/pitscaler","title":"emilstahl/pitscaler","date":"2026-10-01","url":"https://github.com/emilstahl/pitscaler"},{"source":"pocgithub","id":"orjanj/netscaler_threat_hunt_helper","title":"orjanj/netscaler_threat_hunt_helper","date":"2026-10-01","url":"https://github.com/orjanj/netscaler_threat_hunt_helper"},{"source":"pocgithub","id":"watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs","title":"watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs","date":"2026-10-02","url":"https://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs"},{"source":"pocgithub","id":"grupooruss/netscaler-defensive-checker","title":"grupooruss/netscaler-defensive-checker","date":"2026-10-08","url":"https://github.com/grupooruss/netscaler-defensive-checker"},{"source":"pocgithub","id":"CompleteTech-Security/netscaler-pitscaler-cve-2026-88771-check","title":"CompleteTech-Security/netscaler-pitscaler-cve-2026-88771-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/netscaler-pitscaler-cve-2026-88771-check"}],"products":[{"vendor":"citrix","product":"netscaler"},{"vendor":"citrix","product":"netscaler_application_delivery_controller"},{"vendor":"citrix","product":"netscaler_gateway"},{"vendor":"citrix netscaler","product":"adc"},{"vendor":"citrix netscaler","product":"gateway"},{"vendor":"netscaler","product":"adc"},{"vendor":"netscaler","product":"gateway"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771"},{"url":"https://github.com/advisories/GHSA-mx58-p288-86qp"}],"sources":{"cve":[{"id":"CVE-2026-88771","title":"A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands","description":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","status":"published","published":"2026-09-27T16:02:07.001Z","modified":"2026-09-29T03:55:15.09Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-87958","description":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","status":"published","published":"2026-09-27T16:02:07Z","modified":"2026-09-29T03:55:15Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"exploited_since":"2026-09-27","updated_at":"2026-11-02T17:27:52.331616Z"}],"ghsa":[{"id":"GHSA-mx58-p288-86qp","title":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n...","description":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","status":"published","published":"2026-09-27T18:30:22Z","modified":"2026-09-28T12:32:08Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:12:32.013867Z"}],"kev":[{"id":"CVE-2026-88771","title":"Citrix NetScaler Improper Input Validation Vulnerability","description":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.","cwes":["CWE-119"],"kev":{"date_added":"2026-09-27","due_date":"2026-09-30","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-88771","description":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","status":"published","published":"2026-09-27T17:16:56.26Z","modified":"2026-09-29T04:18:01.603Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:52.081323Z"}]}}