CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-09-27. EPSS: 1.1% chance of exploitation in the next 30 days.

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Affected products

• Citrix NetScaler Application Delivery Controller: from 13.1, before 13.1-64.23 (fixed in 13.1-64.23); from 13.1, before 13.1.37.279 (fixed in 13.1.37.279); from 14.1, before 14.1-73.37 (fixed in 14.1-73.37); from 14.1-66.68, up to and including 14.1-73.37
• Citrix NetScaler Gateway: from 13.1, before 13.1-64.23 (fixed in 13.1-64.23); from 14.1, before 14.1-73.37 (fixed in 14.1-73.37)

Published 2026-09-27. Last modified 2026-09-29.