Zero Radar
← feed
CriticalVulnerabilityCVE-2026-88771updated 25 Oct 2026, 17:35 UTC

Citrix NetScaler ADC and Gateway can let outsiders run commands

Attackers on the internet may be able to send specially crafted requests to Citrix NetScaler devices and make them run commands, without needing a password. These devices sit at the edge of company networks, so a compromise can give attacke

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.5 of 10
Being exploited?YesConfirmed by CISA KEV · 27 Sept 202
Fix available?YesADC 14.1-73.37 or later; ADC 13.1-64.23 or later; ADC 14.1-73.37 FIPS or later; ADC 13.1.37.279 FIPS and NDcPP or later; Gateway 14.1-73.37 or later; Gateway 13.1-64.23 or later. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or password needed
  2. 2Crafted request sentReaches exposed NetScaler listener
  3. 3Input not validatedMalicious input is processed
  4. 4Arbitrary command runsCode executes on the appliance
  5. ResultAttacker controls the NetScaler appliance

What happened

Improper input validation in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated remote command execution.

Why it is dangerous: An attacker who succeeds can take control of the appliance and potentially reach internal systems and data; CISA has confirmed exploitation in the wild, so internet-exposed devices are at immediate risk.

Are you affected?

You are affected if you run Citrix NetScaler ADC or NetScaler Gateway on a version older than the fixed releases listed below.

NetScaler ADC before 14.1-73.37; NetScaler ADC before 13.1-64.23; NetScaler ADC FIPS/NDcPP before 13.1.37.279 FIPS and NDcPP; NetScaler Gateway before 14.1-73.37; NetScaler Gateway before 13.1-64.23.

What to do

  1. Identify every NetScaler ADC and Gateway device and check its firmware version
  2. Update affected devices to the fixed versions listed above, prioritizing internet-facing ones
  3. If you cannot patch immediately, apply the vendor mitigations and follow CISA BOD 26-04 guidance
  4. Review logs for signs of compromise and run CISA's forensics triage steps if exposure is suspected

Timeline

  1. 27 Sept 2026, 00:00 UTC
    Publicly disclosed
  2. 27 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-88771 · GHSA-mx58-p288-86qp
CVSS
9.5 / 10
EPSS
82% chance of exploitation within 30 days
Disclosed
27 Sept 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Citrix NetScaler ADC and Gateway can let outsiders run commands · Zero Radar