Improper input validation in Citrix Netscaler Application Delivery Controller
CVE-2026-88771
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.819, 99.7th percentile (scored ); up from 0.011 30 days earlier. About EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.819 · change: +0.808
Affected products
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Browse the full CISA KEV catalog with PoC counts, Metasploit modules and EPSS.
Public exploits and proof-of-concept code
Metasploit modules
18 public repositories with exploit or proof-of-concept code for this CVE:
- watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 (23 stars, last pushed 2026-09-28)
- ThomasPoppelgaard/netscaler-ctx697096-checker (22 stars, last pushed 2026-11-12): Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697305 (28 CVEs, fixed in 14.1-73.58 / 13.1-64.39), CTX697263 php2shell, CTX697191, CTX697174 and CTX697096 (CVE-2026-88771–88778)…
- technion/netscaler_scanner (1 star, last pushed 2026-10-09): Tooling related to CVE-2026-88771 and CVE-2026-88772
- grupooruss/netscaler-defensive-checker (1 star, last pushed 2026-10-08): Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778
- craigsblackie/cve-2026-88771-netscaler (1 star, last pushed 2026-09-28)
- orjanj/netscaler_threat_hunt_helper (last pushed 2026-10-28): NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
- emilstahl/pitscaler (last pushed 2026-10-28): PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com
- CompleTech-Security/netscaler-cve-2026-88771-check (last pushed 2026-10-26): Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
- CompleteTech-Security/netscaler-cve-2026-88771-check (last pushed 2026-10-26): Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
- CompleTetech-Security/netscaler-cve-2026-88771-check (last pushed 2026-10-26): Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
8 more are listed on the interactive page.
References
- support.citrix.com/support-home/kbsearch/article (Vendor Advisory)
- www.cisa.gov/known-exploited-vulnerabilities-catalog (US Government Resource)
This CVE has public exploit evidence. See the latest CVEs with public exploits.