CVE-2026-88771
CVE-2026-88772 · CVE-2026-88779Attackers can run commands and crash Citrix NetScaler appliances
Several flaws in Citrix NetScaler ADC and NetScaler Gateway let an unauthenticated attacker run commands or crash the appliance. The most serious, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited, and CISA has added them plus CVE-2026-88779 to its known-exploited list. Fixes are available in updated NetScaler releases.
Citrix NetScaler · Updated 28 Oct · From 4 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 27 Sept; US agencies must fix by 30 Sept
SeveritycriticalCVSS 9.5 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| ADC 14.1-73 | 14.1-73.37 |
| Gateway 14.1-73 | 14.1-73.37 |
| ADC 13.1 | 13.1.37.279 FIPS and NDcPP |
| ADC 13.1-64 | 13.1-64.23 |
What to do
- Apply the Citrix fixes: ADC and Gateway 14.1-73 to 14.1-73.41, ADC and Gateway 13.1-64 to 13.1-64.28, and ADC 13.1-37 to 13.1-37.282, which cover CVE-2026-88779 in addition to the earlier flaws.
- For CVE-2026-88771 and CVE-2026-88772, upgrade to ADC 14.1-73.37, Gateway 14.1-73.37, ADC and Gateway 13.1-64.23, or ADC 13.1.37.279 FIPS and NDcPP.
- If you cannot patch immediately, follow CISA's order for US federal agencies to fix by the deadlines and treat any exposed NetScaler SAML interface as at risk until updated.
- Check for signs of compromise such as web shells and tunneling malware, because attackers have been exploiting these flaws since at least early September.
What happened
- 27 SeptCISA adds CVE-2026-88771 and CVE-2026-88772 to its known-exploited list, with a federal fix deadline of 2026-09-30.
- 28 SeptCitrix discloses eight NetScaler vulnerabilities, including two critical flaws already under active attack.
- 29 SeptResearchers report attackers exploiting a NetScaler zero-day since at least early September to deploy web shells and steal credentials.
- 4 OctCitrix releases emergency updates for CVE-2026-88779 and CISA adds it to the known-exploited list.
- 6 OctCISA confirms active exploitation of CVE-2026-88779 and orders federal agencies to patch by Wednesday.
- 19 OctRapid7 publishes analysis of intrusions chaining CVE-2026-88771 and CVE-2026-88779.
The 3 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-88771 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | critical 9.5 | 27 Sept | 82% |
| CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | critical 9.5 | 27 Sept | 78% |
| CVE-2026-88779 | Memory overflow vulnerability leading to Denial of Service | high 8.7 | 4 Oct | 11% |
Our reporting
6 OctCitrix NetScaler zero-day under active exploitation, CISA orders federal agencies to patch4 OctCitrix patches exploited NetScaler SAML zero-day flaw, warns of targeted attacks29 SeptCitrix NetScaler zero-day exploited in active attacks to deploy web shells and steal credentials28 SeptCitrix NetScaler critical flaws under active attack, CISA warnsReported elsewhere
Rapid7 · 19 OctRapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 ↗The records
CISA known-exploited catalog ↗CVE-2026-88771 on NVD ↗CVE-2026-88772 on NVD ↗CVE-2026-88779 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works