{"id":"CVE-2026-88771","published":"2026-09-27T17:16:56Z","modified":"2026-09-29T04:18:01Z","title":"Citrix NetScaler Improper Input Validation Vulnerability","vendor":"Citrix","product":"NetScaler","tier":"core","eol":null,"description":{"text":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.","provenance":"source","from":"NVD"},"summary":{"text":"An improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway affects ADC builds before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway builds before 14.1-73.37 and before 13.1-64.23. An unauthenticated remote attacker with network access can execute arbitrary commands on the affected appliance, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:47Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.8216,"percentile":0.99655,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-09-27","dueDate":"2026-09-30","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-09-27","exploitedFirstSeen":"2026-09-27","ransomware":false,"evidence":[{"url":"https://support.citrix.com/external/article/CTX697096","date":"2026-09-27"},{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27"},{"url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/","date":"2026-09-28"},{"url":"https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation","date":"2026-09-28"},{"url":"https://x.com/DefusedCyber/status/2104602270444736911","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2026-88771","date":"2026-09-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2026-88771","date":"2026-09-30"},{"url":"https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2026-88771","date":"2026-10-01"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability","url":"https://otx.alienvault.com/pulse/6ae28386158c5f73da5c681b","created":"2026-10-28"},{"name":"Node2Shell / HTTP2Shell Vulnerability May Allow RCE","url":"https://otx.alienvault.com/pulse/6ae280ad7e93493f1842dcc5","created":"2026-10-28"},{"name":"Node2Shell / HTTP2Shell Vulnerability May Allow RCE","url":"https://otx.alienvault.com/pulse/6ae2424aa801637ecf4942df","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploitation of public-facing gateway appliance","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"leading to an unauthenticated attacker to execute arbitrary commands","start":269,"end":337}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: attacker executes arbitrary commands on appliance","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to an unauthenticated attacker to execute arbitrary commands","start":269,"end":337}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-87958","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958","exploited":true,"exploitedSince":"2026-09-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":1,"earliest":"2026-09-27","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","repos":[{"name":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","stars":22,"created":"2026-09-27"},{"name":"ThomasPoppelgaard/netscaler-ctx697096-checker","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","stars":22,"created":"2026-09-28"},{"name":"technion/netscaler_scanner","url":"https://github.com/technion/netscaler_scanner","stars":1,"created":"2026-09-28"},{"name":"craigsblackie/cve-2026-88771-netscaler","url":"https://github.com/craigsblackie/cve-2026-88771-netscaler","stars":1,"created":"2026-09-28"},{"name":"grupooruss/netscaler-defensive-checker","url":"https://github.com/grupooruss/netscaler-defensive-checker","stars":1,"created":"2026-10-08"}]},"metasploit":[{"name":"Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","module":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","type":"exploit","disclosureDate":"2026-09-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"}],"first":{"date":"2026-09-27","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-09-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","provenance":"source"},{"date":"2026-09-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-09-27","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","provenance":"source"},{"date":"2026-09-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.citrix.com/external/article/CTX697096","provenance":"source"},{"date":"2026-09-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-09-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 34 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}