CVE-2026-88771
Netscaler Application Delivery Controller95/100
confirmed exploited
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.011 (probability of exploitation) · CVSS base 9.5 · 8 public PoC/exploit reference(s) available
Public PoC / Exploit8
Defensive review only — these references demonstrate exploitability.
githubwatchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 (★23)githubThomasPoppelgaard/netscaler-ctx697096-checker (★14)githubtechnion/netscaler_scanner (★0)githubEXEcution-py/CVE-2026-88771-POC (★0)githubcraigsblackie/cve-2026-88771-netscaler (★0)vulncheck-xdbVulnCheck XDB 0a8c0d27 (initial-access)vulncheck-xdbVulnCheck XDB 3d8733b6 (initial-access)githubtechupdate24/citrix-netscaler-cve-2026-88771-rce (★0)
References6
Mentions 20