Browse rankings
All news & advisories
Actively exploited

CVE-2026-88771: Actively Exploited Vulnerability

CVE-2026-88771 CVSS 9.8 CISA KEV · actively exploited
Who it affects
See the summary below.
What to do
Patch immediately — prioritise internet-facing systems.

CVE-2026-88771 Advisory

Severity: CRITICAL (CVSS 9.8)
Status: Actively exploited (KEV catalog)

Affected Products

  • Citrix NetScaler ADC versions before:

    • 14.1-73.37
    • 13.1-64.23
    • 14.1-73.37 FIPS
    • 13.1.37.279 FIPS and NDcPP

  • Citrix NetScaler Gateway versions before:

    • 14.1-73.37
    • 13.1-64.23

Vulnerability

Improper input validation in NetScaler ADC and Gateway allows unauthenticated attackers to execute arbitrary commands.

Remediation

Update to patched versions:

  • NetScaler ADC: 14.1-73.37 or later (including FIPS variants)
  • NetScaler ADC: 13.1-64.23 or later (including 13.1.37.279 FIPS/NDcPP)
  • NetScaler Gateway: 14.1-73.37 or later
  • NetScaler Gateway: 13.1-64.23 or later

References

Data as of September 28, 2026. Sources: nvd.nist.gov, support.citrix.com, cisa.gov. Figures are pulled from public vendor and security data and refreshed automatically.
Back to all news & advisories