cyfenced.com →

[ CVE-2026-88771 · Published 27 Sep 2026 ]

Unauthenticated command execution in NetScaler ADC and Gateway

Exploited · CISA KEV CVSS 9.8 EPSS 1%5 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-27
  • Critical severity: CVSS 9.8
  • Urgent advisory from CERT-EU, CERT-FR, NCSC-NL

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and the flaw can be triggered over the network without credentials or user interaction.

Red alert if
You run NetScaler ADC or NetScaler Gateway on a version older than the fixed builds, especially if it is reachable from the internet.
Can wait if
You do not use NetScaler, or you already run 14.1-73.37, 13.1-64.23 or a later build.
What it is
An input validation flaw in Citrix NetScaler ADC and NetScaler Gateway lets an attacker run commands on the appliance without logging in. Versions before 14.1-73.37 and 13.1-64.23 are affected, as are the FIPS and NDcPP builds before 14.1-73.37 FIPS and 13.1.37.279.
Impact
Anyone who can reach the appliance over the network can take full control of it, with no password and no user action needed. NetScaler usually sits at the edge and handles remote access, so a compromised appliance gives an attacker a foothold inside the network and a view of the sessions and credentials passing through it.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted requests to the NetScaler interface exposed to the internet.
  2. T1059.004 Command and Scripting Interpreter: Unix ShellThe flaw lets them run shell commands on the appliance itself.
  3. T1505.003 Server Software Component: Web ShellAttackers commonly leave a web shell on edge appliances so they keep access after a reboot or patch.
  4. T1078 Valid AccountsCredentials and sessions taken from the gateway are reused to log in to internal systems.

What to do

  1. Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 or later (FIPS and NDcPP builds to 14.1-73.37 FIPS or 13.1.37.279), following Citrix bulletin CTX697096. Go straight to 14.1-73.41 or 13.1-64.28 if you can: those builds also fix the exploited denial of service flaw CVE-2026-88779.
  2. If you cannot upgrade today, restrict access to the management and gateway interfaces to known addresses until you can.
  3. Check the appliance for signs of compromise using the indicators and steps in Citrix's guidance for a suspected compromised NetScaler.
  4. Because exploitation is confirmed, reset credentials and end active sessions that passed through the gateway if you find any sign of compromise.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

CISA: Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 30 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References