CVE · Exploited · On CISA KEV

CVE-2026-88771

Citrix NetScaler Improper Input Validation Vulnerability

9.8: CVSS 3.1
2: stories
SEP 27: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Citrix
Product: NetScaler
Published: Sep 27, 2026
Added to KEV: Sep 27, 2026
KEV deadline: Sep 30, 2026
Ransomware use: Unknown
Weakness: CWE-20

What it is

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑

SEP 27
VulnerabilitiesResearchers Warn of Citrix NetScaler ExploitationOn Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.DENNIS FISHER · 3 MIN
OCT 3
VulnerabilitiesNew Citrix NetScaler Issue EmergesThe vendor says this is a configuration-dependent issue rather than a failure of the security patches themselves.DENNIS FISHER · 3 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysupport.citrix.com/support-home/kbsearch/article