CVE Details

CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability
Published: 2026-09-27 CVSS: 9.5 CRITICAL Product: Citrix NetScaler Due Date: 2026-09-30

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • murrez/CVE-2026-88772 • ⭐ 2 • 2026-09-27 • Conf: 90.0%
  • CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.5
  • Severity: CRITICAL
  • Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-88771
cveMetadata > assignerOrgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName NetScaler
cveMetadata > dateReserved 2026-09-10T07:14:57.369Z
cveMetadata > datePublished 2026-09-27T16:02:07.001Z
cveMetadata > dateUpdated 2026-09-27T19:57:15.713Z
containers > cna > providerMetadata > orgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
containers > cna > providerMetadata > shortName NetScaler
containers > cna > providerMetadata > dateUpdated 2026-09-27T16:02:07.001Z
containers > cna > title A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
containers > cna > datePublic 2026-09-27T15:51:00.000Z
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-20
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-20 Improper input validation
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > affected > 0 > vendor Citrix NetScaler
containers > cna > affected > 0 > product ADC
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > lessThan 14.1-73.37
containers > cna > affected > 0 > versions > 0 > versionType patch
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 0
containers > cna > affected > 0 > versions > 1 > lessThan 13.1-64.23
containers > cna > affected > 0 > versions > 1 > versionType patch
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 0
containers > cna > affected > 0 > versions > 2 > lessThan 14.1-73.37 FIPS
containers > cna > affected > 0 > versions > 2 > versionType patch
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > version 0
containers > cna > affected > 0 > versions > 3 > lessThan 13.1.37.279 FIPS and NDcPP
containers > cna > affected > 0 > versions > 3 > versionType patch
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 1 > vendor Citrix NetScaler
containers > cna > affected > 1 > product Gateway
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 0
containers > cna > affected > 1 > versions > 0 > lessThan 14.1-73.37
containers > cna > affected > 1 > versions > 0 > versionType patch
containers > cna > affected > 1 > versions > 1 > status affected
containers > cna > affected > 1 > versions > 1 > version 0
containers > cna > affected > 1 > versions > 1 > lessThan 13.1-64.23
containers > cna > affected > 1 > versions > 1 > versionType patch
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.<p>This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to&nbsp;<span>an unauthenticated attacker to execute arbitrary commands.&nbsp;</span></p>
containers > cna > references > 0 > url https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV4_0 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV4_0 > attackRequirements PRESENT
containers > cna > metrics > 0 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > vulnIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > exploitMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > version 4.0
containers > cna > metrics > 0 > cvssV4_0 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV4_0 > baseScore 9.5
containers > cna > metrics > 0 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
containers > cna > source > discovery UNKNOWN
containers > cna > x_generator > engine Vulnogram 1.0.4
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-27T19:57:06.610147Z
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-88771
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-27T19:57:15.713Z