A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Vulnerability: CVE-2026-88771 is a remote code execution vulnerability affecting Citrix Netscaler appliances in default configurations that allows unauthenticated access. The vulnerability is being exploited in chains with CVE-2026-88772 and CVE-2026-88773 to achieve unauthorized RCE.
Trending: The vulnerability is trending due to active exploitation in the wild throughout September, with attackers deploying webshells on affected systems. Security researchers attribute the attacks to well-resourced, likely nation-state aligned threat actors conducting espionage operations, and patches remain pending QA approval at Citrix.
Citrix just confirmed two critical NetScaler RCE zero-days (CVE-2026-88771 & CVE-2026-88772) are being exploited in the wild. CISA added them to KEV with a Sept 30 deadline for feds. If you run NetScaler ADC/Gateway — patch to 14.1-73.37 / 13.1-64.23 now. secnewsheadlines.com/p/citrix-net...
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 ...
CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. #CISA #KEV #Citrix #zeroday #CVE
Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)
Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 - SOCRadar
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
Citrix confirms two NetScaler RCE zero-days exploited in attacks
Netscaler CVEs are out: Patch isn’t yet through QA at Citrix still, been a week :02angery: The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained. It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September. Probably nation state aligned as well resourced, espionage rather than teens.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
