Citrix NetScaler RCE CVE-2026-88771 Actively Exploited Worldwide
CISA adds critical NetScaler flaw to known exploited list after Citrix confirms unauthenticated remote code execution attacks on ADC and Gateway appliances.
Key points
- CVE-2026-88771 allows unauthenticated remote code execution on NetScaler ADC and Gateway without enabling optional features.
- Zscaler ThreatLabz observed exploitation chains involving access-log poisoning, web shell deployment, and FreeBSD implant delivery.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog following reports of global active exploitation.
Citrix disclosed CVE-2026-88771 on September 27, 2026, a critical remote code execution flaw in NetScaler Application Delivery Controller and NetScaler Gateway. The vulnerability enables unauthenticated attackers to execute arbitrary commands on affected appliances without requiring any optional features to be enabled.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog after Citrix confirmed active exploitation on unmitigated systems worldwide. The flaw carries a CVSS v3.1 score of 9.8 according to the NVD and a CVSS v4.0 score of 9.5 per Citrix bulletin CTX697096.
Exploitation Tactics and Infrastructure
Zscaler ThreatLabz researchers observed a staged exploitation chain that included access-log poisoning, pre-authentication remote command execution, and appliance fingerprinting. Attackers attempted to deploy multiple web shells and delivered a FreeBSD x64 implant from infrastructure previously linked to StyleSmuggler exploitation.
This infrastructure overlap provides an investigative lead but does not establish threat actor attribution. Shared hosting, compromised infrastructure, or payload reuse by unrelated operators could explain the connection between the NetScaler attacks and earlier Adobe Commerce vulnerabilities.
Affected Systems and Secondary Flaws
CVE-2026-88771 affects NetScaler ADC and NetScaler Gateway across multiple versions. Citrix has since disclosed another critical vulnerability, CVE-2026-107406, which can lead to remote code execution or denial of service on appliances configured as SAML service providers or identity providers.
Organizations running these appliances must identify exposed systems and determine their software versions immediately. CISA warns that updating appliances may remove or reduce forensic visibility, so preserving evidence before patching is critical for incident response teams.
What should you do?
Citrix recommends installing specific builds or later releases for NetScaler ADC and Gateway versions 14.1, 13.1, 14.1-FIPS, 13.1-FIPS, and 13.1-NDcPP. Organizations should isolate potentially compromised appliances from untrusted networks while preserving forensic evidence such as VM snapshots and syslog data.
Security teams should proactively hunt for signs of compromise by checking for unauthorized child shells under the /nobody/ service account. Administrators should also compare configuration files against known-good systems and search HTTP access logs for suspicious User-Agent values or paths associated with this CVE.
What to do and how to stay safe: Citrix
- Inventory all NetScaler ADC and Gateway appliances to determine software versions and internet exposure status.
- Preserve forensic evidence by capturing VM snapshots and collecting syslog data before applying any updates.
- Search HTTP access logs for Base64-encoded content in User-Agent fields and unexpected configuration changes.
- Isolate potentially compromised appliances from untrusted networks to prevent lateral movement while investigating.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-88771 require authentication to exploit?
No, the vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances without requiring optional features.
Is there a confirmed threat actor behind these attacks?
No, Zscaler notes that infrastructure overlap does not establish attribution, as shared hosting or payload reuse could explain the connection.
Which Citrix products are affected by CVE-2026-88771?
The vulnerability affects NetScaler Application Delivery Controller and NetScaler Gateway across multiple supported versions.
