Citrix NetScaler CVE-2026-88771: exploited remote code execution without sign-in

Summary

• On 27 September 2026, Citrix disclosed CVE-2026-88771, an input validation flaw in NetScaler ADC and NetScaler Gateway. It lets an attacker run code without signing in. It scores 9.5 on CVSS 4.0.
• The same bulletin covers CVE-2026-88772 to CVE-2026-88778. CVE-2026-88772 is also exploited.
• Citrix has since published three more bulletins, so the first fixed build is no longer the one to aim for.

Exposure

• Citrix says all deployments are affected in their default configuration, and no special feature is needed.
• Affected by CVE-2026-88771:
  • ADC and Gateway 14.1 before 14.1-73.37
  • ADC and Gateway 13.1 before 13.1-64.23
  • ADC 14.1 FIPS before 14.1-73.37 FIPS
  • ADC 13.1 FIPS and NDcPP before 13.1-37.279
• Secure Private Access Hybrid deployments using NetScaler are also affected. Citrix patches its own managed cloud services, so customers need do nothing there.
• CVE-2026-88772 needs DTLS, which is on by default on VPN virtual servers.

Later bulletins raise the build you need:

• CVE-2026-88779 (3 October): denial of service on SAML setups. Fixed in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 FIPS and NDcPP. CISA added it to the KEV catalog on 4 October.
• CVE-2026-107406 (8 October): memory overflow leading to code execution or denial of service on SAML setups, CVSS 9.5. Builds 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28 are still affected as a SAML identity provider. Fixed in 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1.37.283. Citrix's bulletin makes no statement on exploitation, and it was not in the KEV catalog when we checked.
• CVE-2026-109618 and CVE-2026-109619 (22 October, revised 27 October): PHP bugs inside NetScaler. Fixed in 14.1-73.49, 13.1-64.32, 14.1-73.49 FIPS and 13.1.37.286. CISA lists both PHP bugs as exploited, but Citrix's advisory says nothing about attacks on NetScaler itself.

Exploitation: established.

• Citrix says it has observed exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments.
• CISA added both to the KEV catalog on 27 September 2026, with a due date of 30 September and forensic triage required. Its ransomware field says unknown.
• Unit 42 reports attacks before disclosure: on 21 September, a three-stage chain using CVE-2026-88771 dropped a PHP web shell on a US-based target.

Actions

1. Keep the NetScaler management interface off the public internet.
2. Check for compromise before you change anything, because an upgrade can disturb evidence. Unit 42 lists these web shell paths:
   • CVE-2026-88771: /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, served as /logon/LogonPoint/custom/receiver.min.css
   • CVE-2026-88772: /vpn/scripts/linux/nsgclient18.deb and /vpn/scripts/linux/nsg64.deb
3. Run Citrix's indicator scan in NetScaler Console if you have it. Its docs warn that a "No Compromise Detected" result does not rule out compromise, and that it depends on telemetry.
4. Upgrade to the newest fixed builds or later:
   • ADC and Gateway 14.1: 14.1-73.49
   • ADC and Gateway 13.1: 13.1-64.32
   • ADC 14.1 FIPS: 14.1-73.49 FIPS
   • ADC 13.1 FIPS and NDcPP: 13.1.37.286
5. Check your SAML setup, because earlier fixes left SAML identity providers exposed. Citrix's bulletin names add authentication samlAction for a service provider and add authentication samlIdPProfile for an identity provider in the configuration.
6. If you find signs of compromise, follow Citrix's guide:
   • Preserve evidence first: VPX snapshot, time of capture, support bundle, and NSPPE core.
   • Isolate the appliance.
   • Revoke secrets it held: LDAP, RADIUS, OAuth, API keys, SNMP, and certificates with their keys.
   • Investigate connected systems.
   • Rebuild, upgrade firmware, and only then restore a known-good configuration.
   • Monitor for 90 days.
7. Treat an unpatched appliance that was reachable from the internet on or after 21 September as suspect, even if your scan is clean. This is our reading of the dates above, not Citrix's wording.

Sources

• Citrix CTX697096: vendor advisory. CVE-2026-88771 and 88772, affected builds, preconditions, observed exploits.
• CVE-2026-88771: CVE record. Affected builds and publication date.
• CISA KEV feed, version 2026.11.04: CISA KEV. Listing dates, due dates, forensic triage, and no listing for CVE-2026-107406.
• Citrix CTX697174: vendor advisory. CVE-2026-88779 and its fixed builds.
• Citrix CTX697191: vendor advisory. CVE-2026-107406, SAML conditions, fixed builds.
• Citrix CTX697263: vendor advisory. PHP bugs in NetScaler, newest fixed builds.
• Citrix CTX694799: vendor guide. Evidence, isolation, secrets, rebuild, monitoring, management access.
• NetScaler Console indicators: vendor docs. Scan limits.
• NetScaler Console security advisories: vendor docs. Newest listed CVEs as of 4 November.
• Unit 42 threat brief: research. Attack on 21 September, web shell paths, persistence after patching.