{"id":"CVE-2026-88772","published":"2026-09-27T17:16:56Z","modified":"2026-09-28T12:26:47Z","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","vendor":"Citrix","product":"NetScaler","tier":"core","eol":null,"description":{"text":"Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper restriction of operations within the bounds of a memory buffer, found in the NetScaler component of Citrix NetScaler ADC and Citrix NetScaler Gateway. An attacker with network access and no authentication or user interaction can, under the high-complexity conditions of the attack vector, achieve remote code execution or denial of service on affected builds.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:44Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.78162,"percentile":0.99577,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-09-27","dueDate":"2026-09-30","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-09-27","exploitedFirstSeen":"2026-09-27","ransomware":false,"evidence":[{"url":"https://support.citrix.com/external/article/CTX697096","date":"2026-09-27"},{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27"},{"url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/","date":"2026-09-28"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/","date":"2026-09-29"},{"url":"https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/","date":"2026-10-06"},{"url":"https://asec.ahnlab.com/en/95733/","date":"2026-10-07"},{"url":"https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/","date":"2026-10-07"},{"url":"https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg","date":"2026-10-13"},{"url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","date":"2026-10-13"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779","url":"https://otx.alienvault.com/pulse/6ad9e56501231f12ba7e0b5e","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Public-facing appliance is the exploited entry point","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Citrix NetScaler ADC and Citrix NetScaler Gateway","start":17,"end":66}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote code execution yields command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to Remote Code Execution or Denial of Service","start":243,"end":296}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-87959","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87959","exploited":true,"exploitedSince":"2026-09-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2026-09-27","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","repos":[{"name":"murrez/CVE-2026-88772","url":"https://github.com/murrez/CVE-2026-88772","stars":12,"created":"2026-09-27"},{"name":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","stars":11,"created":"2026-09-27"},{"name":"FollowerSeize/CVE-2026-88772-POC","url":"https://github.com/FollowerSeize/CVE-2026-88772-POC","stars":0,"created":"2026-09-28"},{"name":"CompleteTech-Security/netscaler-pitscaler-cve-2026-88772-check","url":"https://github.com/CompleteTech-Security/netscaler-pitscaler-cve-2026-88772-check","stars":0,"created":"2026-10-23"}]},"metasploit":[{"name":"Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","module":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","type":"exploit","disclosureDate":"2026-09-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"}],"first":{"date":"2026-09-27","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-09-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88772","provenance":"source"},{"date":"2026-09-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-09-27","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","provenance":"source"},{"date":"2026-09-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.citrix.com/external/article/CTX697096","provenance":"source"},{"date":"2026-09-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-09-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87959","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":78.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 34 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}