CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-09-27Vulnerability

CVE-2026-88771

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

Properties

Euvd product
Gateway, ADC
Vulnerability name
Citrix NetScaler Improper Input Validation Vulnerability
First seen
2026-09-29T03:55:15+00:00
Cvss score
9.8
Epss score
0.81894
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-09-30
Euvd assigner
NetScaler
Retrieved at
2026-11-12T03:53:42+00:00
Exploited euvd since
2026-09-27T00:00:00+00:00
Src batch id
euvd-20261106T073401Z-826fba
Source url
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958
Date added
2026-09-27
Score
9.8
Euvd base score version
4.0
Fetched at
2026-11-06T07:34:03+00:00
Euvd vendor
Citrix NetScaler, NetScaler
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
First seen by Signal
2026-09-28T04:26:27+00:00
Euvd base score
9.5

Related Entities (16)

MENTIONED_IN (9)

→[Campaign]Node2Shell / HTTP2Shell Vulnerability May Allow RCE
→[Campaign]NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
→[Campaign]CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
→[Campaign]Threat Overview: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Being Exploited in Production Environments (Updated September 30)
→[Campaign]Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
→[Campaign]TIKTOUK: Tracing a WordPress Credential Collection Toolkit
→[Campaign]Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
→[Campaign]PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578
→[Campaign]Swarming Against Citrix 0-Day Exploitation

AFFECTS_PRODUCT (4)

→[Product]citrix netscaler gateway
→[Product]citrix netscaler application delivery controller
→[Product]citrix netscaler application delivery controller
→[Product]citrix netscaler application delivery controller

DESCRIBES (1)

←[KEVEntry]Citrix NetScaler Improper Input Validation Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Input Validation

INVOLVES (1)

←[Signal]kev_added · 2026-09-27

Related research

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-88771 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal