CVE-2026-88771
Critical input-validation flaw giving Remote Code Execution on NetScaler ADC and Gateway.
Citrix disclosed CVE-2026-88771 on 27 September 2026 as an already-exploited NetScaler flaw, then on 4 October replaced its own fixed builds with 14.1-73.41 and 13.1-64.28 after a third flaw surfaced in attacks.
Last refreshed: 12 October 2026
Why did NetScaler owners who patched in September have to patch again?
Timeline for CVE-2026-88771
Mentioned in: Citrix replaces its own NetScaler fix
Cybersecurity: Threats and DefencesBackground
CVE-2026-88771 is an improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that gives an unauthenticated attacker command execution on the appliance.
Citrix bulletin CTX697096 rates it 9.5 under CVSS 4.0 and says every deployment is exposed, default configurations included. Citrix reported exploits against unmitigated appliances, and CISA added the flaw to its exploited list on the day of disclosure, 27 September 2026.
NetScaler appliances sit at the network EDGE and handle remote logins for the organisations behind them. Command execution on a NetScaler box therefore puts the passwords and keys it stores for the wider network within an attacker's reach, which is why the flaw matters beyond the box itself.
The first fix did not hold
Citrix published CVE-2026-88771 on 27 September 2026 and said attackers had used it, alongside a second NetScaler flaw, before any fix existed. CISA listed it as exploited that day. Citrix's original patched releases were 14.1-73.37 on the 14.1 branch and 13.1-64.23 on 13.1.
Citrix's September builds did not last. On 4 October Citrix superseded them with 14.1-73.41 and 13.1-64.28 after a third flaw appeared in attacks, so an appliance updated in September needed a second round. Rapid7 then found stolen NetScaler settings files holding directory passwords and private keys. A clean build does not revoke credentials an intruder already copied, so on any appliance exposed to CVE-2026-88771 the keys and passwords need replacing too.