CVE-2026-88771 Exploited in the wild

Citrix NetScaler Improper Input Validation Vulnerability

Risk score: 100/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 5.1%
Published: 27 Sep 2026
Added to CISA's exploited list: 27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands due to improper input validation.
Affected: {'products': ['Citrix NetScaler ADC', 'Citrix NetScaler Gateway'], 'packages': [], 'versions': ['before 14.1-73.37', 'before 13.1-64.23', 'before 14.1-73.37 FIPS', 'before 13.1.37.279 FIPS and NDcPP']}
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Citrix Netscaler: Red, act today. A critical vulnerability in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands due to improper input validation.

The flaws

CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability (CVSS 9.8 · EPSS 5% · exploited)
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 8.1 · EPSS 5% · exploited)
CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 7.5 · EPSS 1% · exploited)
CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (exploited)

The fix

Upgrade Citrix Netscaler: 14.1 · 13.1 · 13.1.37.279 or later on your release line

Who is exposed: {'products': ['Citrix NetScaler ADC', 'Citrix NetScaler Gateway'], 'packages': [], 'versions': ['before 14.1-73.37', 'before 13.1-64.23', 'before 14.1-73.37 FIPS', 'before 13.1.37.279 FIPS and NDcPP']}

Where it stands

Exploited in the wild
On CISA's exploited list since 9 Sep
US federal deadline 12 Sep

How it unfolded

9 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
12 Sep, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Memory corruption (CWE-119). 270 other warnings in 30 days

Why it is Red

CVSS 9.8 critical
Exploitation likely: EPSS 5.1% (top 8%)
Exploited in the wild (CISA KEV)
Remotely exploitable without logging in
On your watchlist: citrix

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Last activity 27 Sep 2026. Patch Forecast updates every hour.