Citrix NetScaler ADC and Gateway Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-88771)

Affected Vendors

Citrix

Affected Components

NetScaler ADC, NetScaler Gateway

Published Date

2026-09-27

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

Impact

Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

Mitigation

Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

Affected Products & Version Scope

Affected versions include NetScaler ADC and Gateway 14.1 (before 14.1-73.37) and 13.1 (before 13.1-64.23). FIPS-certified and NDcPP-compliant versions are also impacted.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

The primary remediation is to upgrade to the fixed versions specified in Citrix advisory CTX697096. If immediate patching is not feasible, implement the following mitigations:

Isolate Management Interface: Ensure the NetScaler IP (NSIP) and management GUI/SSH are not reachable from the public internet.
Implement ACLs: Restrict management access to a dedicated, secure management VLAN or trusted source IP ranges only.
Monitor for IoCs: Inspect system logs and HTTP access logs for unusual activity or unauthorized shell command execution.

bash

# Check current version via CLI
show version

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Download and install the latest firmware updates from the Citrix Support Portal immediately to mitigate the risk of exploitation.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

CVE-2026-88771 is a critical vulnerability caused by improper input validation (CWE-20) in Citrix NetScaler ADC and Gateway. It allows an unauthenticated attacker to achieve Remote Code Execution (RCE) by sending a specifically crafted request to the target appliance. The vulnerability is currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. With an EPSS score of 0.94, the probability of encountering an exploit attempt is extremely high. Given that these devices often sit at the edge of the network, this flaw serves as a high-value target for threat actors seeking initial access to corporate environments.

Official Vendor Advisories & References

NVD Original English Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: