CVE-2026-88771: listed in the CISA KEV catalog CVE-2026-88771 · KEV 2026-09-27 · patch available
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Is CVE-2026-88771 exploited? Listed in the CISA KEV catalog on 2026-09-27. Federal remediation due 2026-09-30. Past that date by 27 days. Public exploit code: packaged in a public tool. Which products and versions are affected? Citrix NetScaler · ADC · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23, >= 0, < 14.1-73.37 FIPS, >= 0, < 13.1.37.279 FIPS and NDcPP Citrix NetScaler · Gateway · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23 citrix · netscaler application delivery controller · >= 13.1, < 13.1-64.23, >= 13.1, < 13.1.37.279, >= 14.1, < 14.1-73.37, >= 14.1-66.68, <= 14.1-73.37 (except the fixed hotfixes listed under "Is there a patch?") citrix · netscaler gateway · >= 13.1, < 13.1-64.23, >= 14.1, < 14.1-73.37 Is there a patch? Yes. Update to one of these or later:
ADC 14.1-73.37 · 13.1-64.23 · 14.1-73.37 FIPS · 13.1.37.279 FIPS and NDcPP Gateway 14.1-73.37 · 13.1-64.23
From Citrix NetScaler's CVE record · Citrix NetScaler advisory
netscaler application delivery controller 13.1 13.1-64.23 · 13.1.37.279 netscaler application delivery controller 14.1 14.1-73.37 netscaler gateway 13.1 13.1-64.23 netscaler gateway 14.1 14.1-73.37
From NVD's analysis
What PlainSec published about CVE-2026-88771 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-27.
CVE-2026-88771: listed in the CISA KEV catalog CVE-2026-88771 · KEV 2026-09-27 · patch available
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Is CVE-2026-88771 exploited? Listed in the CISA KEV catalog on 2026-09-27. Federal remediation due 2026-09-30. Past that date by 27 days. Public exploit code: packaged in a public tool. Which products and versions are affected? Citrix NetScaler · ADC · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23, >= 0, < 14.1-73.37 FIPS, >= 0, < 13.1.37.279 FIPS and NDcPP Citrix NetScaler · Gateway · >= 0, < 14.1-73.37, >= 0, < 13.1-64.23 citrix · netscaler application delivery controller · >= 13.1, < 13.1-64.23, >= 13.1, < 13.1.37.279, >= 14.1, < 14.1-73.37, >= 14.1-66.68, <= 14.1-73.37 (except the fixed hotfixes listed under "Is there a patch?") citrix · netscaler gateway · >= 13.1, < 13.1-64.23, >= 14.1, < 14.1-73.37 Is there a patch? Yes. Update to one of these or later:
ADC 14.1-73.37 · 13.1-64.23 · 14.1-73.37 FIPS · 13.1.37.279 FIPS and NDcPP Gateway 14.1-73.37 · 13.1-64.23
From Citrix NetScaler's CVE record · Citrix NetScaler advisory
netscaler application delivery controller 13.1 13.1-64.23 · 13.1.37.279 netscaler application delivery controller 14.1 14.1-73.37 netscaler gateway 13.1 13.1-64.23 netscaler gateway 14.1 14.1-73.37
From NVD's analysis
What PlainSec published about CVE-2026-88771 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-27.