Skip to content
Critical RCE Vulnerability CVE-2026-88771 Exploited in Citrix NetScaler

Critical RCE Vulnerability CVE-2026-88771 Exploited in Citrix NetScaler

First seen 18 Oct 2026, 12:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 12:38 UTC
  • •CVE-2026-88771 allows unauthenticated RCE on Citrix NetScaler systems.
  • •Exploitation confirmed in the wild; CISA added it to the KEV catalog.
  • •Patches are available, but many systems remain unpatched and vulnerable.

CVE-2026-88771 is a critical unauthenticated remote code execution vulnerability affecting Citrix NetScaler ADC and Gateway, disclosed on September 27, 2026. It has a CVSS score of 9.5 and allows attackers to execute arbitrary commands without authentication. Citrix confirmed exploitation on unpatched systems, leading to its addition to CISA's Known Exploited Vulnerabilities catalog. Attackers utilized access-log poisoning to execute commands and deploy web shells. The vulnerability affects multiple versions of NetScaler ADC and Gateway, as well as Adobe Commerce and Magento. Exploitation has been confirmed in the wild, with observed attacks using forged logs and malicious scripts. Citrix has released patches for affected systems, but many remain unpatched. The situation is urgent as continues globally.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-07
CVE-2026-75650 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-27
CVE-2026-88771 disclosed
Citrix disclosed a critical RCE vulnerability affecting NetScaler ADC and Gateway with a CVSS score of 9.5.
www.zscaler.com
2026-09-27
CISA adds CVE-2026-88771 to KEV
CISA confirmed active exploitation of CVE-2026-88771 on unpatched appliances.
www.zscaler.com
2026-10-16
Active exploitation reported
Zscaler ThreatLabz observed a staged exploitation chain involving access-log poisoning and command execution.
www.zscaler.com

More articles in this cluster (5)

Following this threat?

Track Kw2-freebsd-x64-s11, Adobe and CVE-2026-75650 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

Which versions of NetScaler are affected?
Affected versions include Citrix NetScaler ADC and Gateway versions below 14.1-73.46 and 13.1-64.29.
Is there confirmed exploitation of this vulnerability?
Yes, exploitation has been confirmed in the wild, with attacks reported shortly after its disclosure.
What should organizations do to protect themselves?
Organizations should apply the available patches immediately to mitigate the risk of exploitation.