Key points
- Citrix disclosed CVE-2026-88771 on 27 September 2026 as a critical remote code execution flaw in NetScaler ADC and Gateway.
- The vulnerability allows unauthenticated attackers to run arbitrary commands on appliances without enabling optional features.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming active worldwide exploitation of unmitigated systems.
Remote code execution via CVE-2026-88771 gives attackers complete control over NetScaler appliances without requiring user credentials. This critical flaw affects both NetScaler Application Delivery Controller and NetScaler Gateway products, allowing arbitrary command execution in default configurations. The vulnerability carries a CVSS v3.1 score of 9.8, indicating severe risk to network infrastructure and data integrity.
In plain English
The security failure allows an outsider to send malicious instructions to the appliance before any login attempt occurs. Because no optional features need activation, every installed unit is potentially vulnerable. Attackers can run system commands directly, bypassing standard access controls and authentication mechanisms entirely. This exposure turns the gateway into an entry point for deeper network compromise.
The background
Citrix confirmed active exploitation on 27 September 2026, leading the US Cybersecurity and Infrastructure Security Agency to list CVE-2026-88771 in its Known Exploited Vulnerabilities catalog. Zscaler ThreatLabz observed a staged attack chain involving access-log poisoning and web shell deployment. The agency also noted infrastructure overlap with previous StyleSmuggler exploitation, though attribution remains unconfirmed.
What changes now
Citrix released patches for NetScaler ADC and Gateway versions 14.1-73.46 and 13.1-64.29, alongside FIPS and NDcPP builds. Administrators are urged to update immediately while preserving forensic evidence like syslog data and core dumps. Isolation of potentially compromised units from untrusted networks is recommended before applying updates to maintain investigative visibility.
The attacker's path
Teams usually face initial access flaws that bypass authentication entirely. In such events, check whether external-facing services expose default configurations that permit command execution. Verify if logging captures pre-authentication requests to detect early intrusion stages. Ensure isolation protocols exist for compromised endpoints to prevent lateral movement while forensic analysis proceeds.
What to do and how to stay safe: Citrix
- Inventory all NetScaler ADC and Gateway appliances to confirm software versions and internet exposure status.
- Preserve forensic evidence by capturing VM snapshots, syslog data, and technical support bundles before applying patches.
- Isolate potentially compromised appliances from untrusted networks to limit further attacker movement and data exfiltration.
- Monitor HTTP access logs for suspicious User-Agent values and paths associated with known exploitation attempts.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does CVE-2026-88771 allow attackers to do?
It enables unauthenticated remote code execution on NetScaler ADC and Gateway appliances, granting full system control.
Are patches available for this vulnerability?
Yes, Citrix released updates for versions 14.1-73.46, 13.1-64.29, and specific FIPS/NDcPP builds.
Is this vulnerability actively being exploited?
Yes, CISA confirmed active worldwide exploitation and added it to its Known Exploited Vulnerabilities catalog.
