CVE-2026-88771: Citrix NetScaler ADC RCE Vulnerability

CVE-2026-88771 Overview

CVE-2026-88771 is an improper input validation vulnerability [CWE-20] affecting Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway. The flaw allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable appliances. Citrix has published fixes in versions 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS and NDcPP. The Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on exposed NetScaler ADC and Gateway appliances, with confirmed in-the-wild exploitation.

Affected Products

• Citrix NetScaler ADC versions prior to 14.1-73.37 and 13.1-64.23
• Citrix NetScaler ADC FIPS prior to 14.1-73.37 FIPS and 13.1.37.279 FIPS and NDcPP
• Citrix NetScaler Gateway versions prior to 14.1-73.37 and 13.1-64.23

Discovery Timeline

• 2026-09-27 - CVE-2026-88771 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-88771

Vulnerability Analysis

The vulnerability stems from improper input validation [CWE-20] in Citrix NetScaler ADC and NetScaler Gateway. Attacker-supplied input reaches a downstream command execution path without adequate sanitization. An unauthenticated attacker can send a crafted network request to a reachable NetScaler interface and achieve arbitrary command execution on the appliance. Because NetScaler appliances typically sit at the perimeter and terminate authentication, SSL/TLS, and application delivery traffic, successful exploitation yields a privileged position within the network. Compromise can expose session tokens, cached credentials, VPN configurations, and backend application traffic.

Root Cause

The root cause is insufficient validation of untrusted input before it is passed to a sensitive processing component. The CWE-20 classification indicates that the appliance accepts data that violates expected format, length, or character set constraints. This permits attacker-controlled values to influence command construction or execution logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the vulnerable NetScaler management or gateway interface over the network and submits a malicious payload that triggers command execution. Internet-exposed NetScaler Gateway and AAA virtual servers are the highest-risk configurations. Refer to the Citrix Support Article CTX697096 for vendor-published technical specifics.

Detection Methods for CVE-2026-88771

Indicators of Compromise

• Unexpected shell processes or child processes spawned by NetScaler packet engine or management daemons.
• New or modified files in NetScaler web directories such as /netscaler/ns_gui/ or /var/vpn/themes/, which are common web shell staging locations.
• Outbound connections from the appliance to unknown IP addresses, particularly immediately following inbound requests to Gateway or management endpoints.
• Anomalous session or configuration changes recorded in ns.log and auth.log.

Detection Strategies

• Inspect HTTP request logs for malformed or oversized parameters directed at NetScaler Gateway, AAA, or management endpoints.
• Correlate inbound requests with process creation and file write events on the appliance to identify command execution chains.
• Hunt for unauthorized administrative actions, new local accounts, or exported configuration files.

Monitoring Recommendations

• Forward NetScaler syslog, audit, and shell command telemetry to a centralized SIEM for retention and correlation.
• Alert on any shell command execution originating from the NetScaler management plane outside of authorized change windows.
• Monitor egress traffic from NetScaler appliances and restrict it to known destinations using network ACLs.

How to Mitigate CVE-2026-88771

Immediate Actions Required

• Upgrade NetScaler ADC and Gateway to the fixed builds published by Citrix immediately, prioritizing internet-facing appliances.
• Rotate all credentials, API keys, and session secrets stored on or processed by affected appliances, as exploitation may have exposed them.
• Hunt for prior compromise using the indicators listed above before considering the appliance clean, given CISA KEV listing confirms active exploitation.
• Restrict access to the NetScaler management interface (NSIP) to trusted administrative networks only.

Patch Information

Citrix has released fixed versions addressing CVE-2026-88771. Upgrade to 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, or 13.1.37.279 FIPS and NDcPP or later. Full upgrade guidance is available in the Citrix Support Article CTX697096 and the CISA Known Exploited Vulnerabilities Catalog entry.

Workarounds

• No vendor-supplied workaround substitutes for the patch; upgrading is the only reliable remediation.
• Where immediate upgrade is not possible, place NetScaler Gateway and AAA virtual servers behind an authenticating reverse proxy or restrict access by source IP.
• Terminate all active user sessions and invalidate persistent session cookies after patching to evict any attacker-held sessions.

# Configuration example: restrict NetScaler management interface access
# Replace 10.0.0.0/24 with your administrative subnet
add ns acl restrict_mgmt ALLOW -srcIP 10.0.0.0/24 -destIP <NSIP>
add ns acl deny_mgmt DENY -destIP <NSIP>
apply ns acls