{"slug":"citrix-netscaler-cve-2026-88771","title":"Citrix NetScaler RCE (CVE-2026-88771)","shortName":"NetScaler 88771","seoTitle":"NetScaler 88771 (CVE-2026-88771): versions, exploitation & detection","summary":"Unauthenticated command execution in NetScaler ADC and Gateway from improper input validation (CVE-2026-88771, CWE-20). Citrix CVSS 4.0 9.5. NVD CVSS 3.1 9.8. Applies to default configurations. Citrix: exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed. CISA KEV 27 Sep 2026 (catalog 2026.11.06). Rapid7 Metasploit Framework 6.5.9 wrap-up (6 Nov 2026) adds a public module; that is tooling availability, not new exploitation evidence.","isExample":false,"draft":false,"family":"citrix-netscaler-cve-2026-88771","kind":"single-product","aliases":["CVE-2026-88771","NetScaler ADC","NetScaler Gateway"],"publishedAt":"2026-11-09","updatedAt":"2026-11-09","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-88771","cvss":{"cve":"CVE-2026-88771","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","sourceDate":"2026-09-29","checkedDate":"2026-11-09","dateLabel":"NVD Analyzed","sourceLabel":"NVD record (Primary CVSS 3.1 9.8; Citrix CNA also published CVSS 4.0 9.5)","nvdPublishedDate":"2026-09-27"},"epss":{"cve":"CVE-2026-88771","score":0.81894,"percentile":0.99653,"date":"2026-11-08","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88771","checkedDate":"2026-11-09"},"kev":{"cve":"CVE-2026-88771","listed":true,"dateAdded":"2026-09-27","dueDate":"2026-09-30","catalogVersion":"2026.11.06","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-09"},"addedDate":"2026-11-09"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated command execution in NetScaler ADC and Gateway (CVE-2026-88771, CWE-20) on default configurations. NVD CVSS 9.8. Citrix observed exploitation on unmitigated deployments. Listed in CISA KEV on 27 Sep 2026. Rapid7's 6 Nov 2026 Metasploit module is public tooling, listed unverified, not a new in-the-wild report.","action":"Install a CTX697096 fixed build, treat default-config appliances as in scope, and run the Console IoC checks CISA points at."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Exploits observed on unmitigated deployments","observer":"Citrix","date":"2026-09-27","method":"Vendor statement in CTX697096: exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed","sourceUrl":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-09-27","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"whatChanged":{"date":"2026-11-09","items":[{"text":"New catalog page for Citrix NetScaler unauthenticated command execution CVE-2026-88771.","headline":"New catalog page for NetScaler CVE-2026-88771","section":"overview","date":"2026-11-09","kind":"page"},{"text":"Rapid7's 6 Nov 2026 wrap-up lists an unverified Metasploit 6.5.9 login-log module as CVE-2026-88771 (CVE field CVE-2026-88773; no lab build).","headline":"Rapid7 6.5.9 wrap-up lists a login-log module as unverified","section":"pocs","date":"2026-11-09","sourceUrl":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","addedDate":"2026-11-09"},{"text":"Citrix CTX697096 (27 Sep 2026) observed exploits of CVE-2026-88771 and CVE-2026-88772; CISA KEV since 27 Sep (catalog 2026.11.06).","headline":"Citrix observed exploits; CISA KEV since 27 Sep (catalog 2026.11.06)","section":"exploitation","date":"2026-11-09","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","addedDate":"2026-11-09"}]},"whatTheBugIs":"CVE-2026-88771 is improper input validation (CWE-20) in Citrix NetScaler ADC and NetScaler Gateway that can let an unauthenticated attacker execute arbitrary commands. Citrix CTX697096 (27 Sep 2026) rates it CVSS 4.0 9.5 and says the precondition is every ADC and Gateway deployment, including the default configuration. No extra feature has to be enabled. NVD rates CVSS 3.1 9.8 (Primary, Analyzed 29 Sep 2026). CISA listed it in KEV on 27 Sep 2026 as Citrix NetScaler Improper Input Validation Vulnerability (due 30 Sep 2026, ransomware use Unknown, forensic triage Yes). Catalog version checked 2026.11.06.\n\nCitrix: exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed. CVE-2026-88772 is a different bug (DTLS memory overflow, CWE-119) from the same bulletin. This page does not treat 88772 as the 88771 command-execution path.\n\nCTX697096 also lists CVE-2026-88773 (HTTP request smuggling) and other sibling CVEs in the same patch set. Those are not this command-execution bug.\n\nFixed builds start at 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37 FIPS, and 13.1-FIPS/NDcPP 13.1-37.279 (the same bulletin also writes 13.1.37.279). Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are also in scope. The bulletin applies to customer-managed appliances; Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication.\n\nRapid7's 6 Nov 2026 Metasploit Framework 6.5.9 wrap-up (Jack Heysel) adds a module titled Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771), contributed by sfewer-r7, with credit to CERT-EU, Scyrix LLC and watchTowr. Rapid7 lists the module under CVE-2026-88771; the wrap-up CVE reference field is CVE-2026-88773. This page attaches no definitive module-to-CVE label. The wrap-up names no lab build. That posting is tooling availability, not new exploitation evidence.","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads, module options, or usage commands.","steps":[{"id":"reach","label":"Unauthenticated reach","detail":"Network access to an affected NetScaler ADC or Gateway. Citrix: default configuration is enough; no extra feature is required."},{"id":"unsafe","label":"Improper input validation","detail":"Vendor class: CWE-20 improper input validation. Rapid7's wrap-up titles the public module as login-log command injection. Conceptual only."},{"id":"exec","label":"Command execution","detail":"Vendor impact class: unauthenticated arbitrary command execution. Conceptual only."}]},"exploitation":{"kev":{"listed":true,"date":"2026-09-27","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability. dateAdded 2026-09-27, due 2026-09-30. knownRansomwareCampaignUse Unknown. forensicTriage Yes. catalogVersion 2026.11.06, released 2026-11-06T19:44:45.1797Z, checked 9 Nov 2026. CISA's KEV CWE field on this row is CWE-119; Citrix CNA assigns CWE-20 to CVE-2026-88771."},"firstSeen":{"date":"2026-09-27","source":"Citrix (Cloud Software Group)","note":"Vendor states exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed as of the 27 Sep 2026 advisory. Exact first calendar day before that advisory is not established in the primary sources reviewed here."},"vendorStatements":[{"vendor":"Citrix (Cloud Software Group)","date":"2026-09-27","statement":"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","retracted":false}]},"timeline":[{"date":"2026-09-27","event":"Citrix publishes CTX697096. The bulletin says exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed and lists fixed builds.","source":{"title":"CTX697096 Security Bulletin","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","publisher":"Citrix"},"kind":"advisory","key":true,"addedDate":"2026-11-09"},{"date":"2026-09-27","event":"CISA adds CVE-2026-88771 to KEV (due 30 Sep 2026). knownRansomwareCampaignUse Unknown. forensicTriage Yes.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-09"},{"date":"2026-09-27","event":"NVD publishes CVE-2026-88771 (Analyzed 29 Sep 2026). Primary CVSS 3.1 9.8. Citrix CNA CVSS 4.0 9.5. CWE-20.","source":{"title":"NVD CVE-2026-88771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","publisher":"NVD"},"kind":"advisory","addedDate":"2026-11-09"},{"date":"2026-11-06","event":"Rapid7 Metasploit Framework 6.5.9 wrap-up (Jack Heysel) adds a module titled Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771), contributed by sfewer-r7, with credit to CERT-EU, Scyrix LLC and watchTowr. Rapid7 lists the module under CVE-2026-88771; the wrap-up CVE reference field is CVE-2026-88773. Tooling availability, not new exploitation evidence.","source":{"title":"Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","publisher":"Rapid7"},"kind":"poc","key":true,"addedDate":"2026-11-09"}],"openNotes":[{"title":"Rapid7 module-to-CVE mapping is not settled","detail":"Rapid7 lists the Metasploit 6.5.9 module under CVE-2026-88771 in the wrap-up heading. The wrap-up CVE reference field is CVE-2026-88773. Citrix assigns unauthenticated command execution to CVE-2026-88771 and HTTP request smuggling to CVE-2026-88773. This page attaches no definitive module-to-CVE label.","sources":[{"url":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","date":"2026-11-06","publisher":"Rapid7"},{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"}]}],"defenderActions":[{"title":"Upgrade to a fixed NetScaler build","detail":"Install 14.1-73.37 or later, 13.1-64.23 or later, 14.1-FIPS 14.1-73.37 FIPS or later, or 13.1-FIPS/NDcPP 13.1-37.279 or later. Citrix: default-config ADC and Gateway deployments are in scope for CVE-2026-88771. Secure Private Access Hybrid instances that use customer-managed NetScaler also need the same trains.","priority":"now","links":[{"label":"CTX697096","href":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}]},{"title":"Run Console IoC checks and forensic triage","detail":"CISA KEV: running the provided IoCs in the NetScaler console may help identify indicators of exploitation, and forensic triage is required. CISA points at Citrix's published guidance.","priority":"now","links":[{"label":"CISA KEV catalog JSON","href":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"label":"Citrix community bulletin post","href":"https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778"}]}],"detection":[{"title":"NetScaler Console IoC scan hits","detail":"CISA KEV: running the provided IoCs in the NetScaler console may help identify indicators of exploitation. Treat hits as leads, not proof. CISA also requires forensic triage.","logSource":"NetScaler Console Security Advisory / appliance console","kind":"generic","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27"},{"title":"Forwarded NetScaler logs in SIEM","detail":"CISA KEV requires forensic triage. Keep off-box appliance logs from the exposure window. No CVE-2026-88771-specific public Sigma or Splunk rule is cited here.","logSource":"Forwarded NetScaler logs","kind":"generic","group":"web-proxy","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27"}],"detectionRules":[],"detectionLinks":[{"title":"CTX697096 Security Bulletin (CVE-2026-88771 through CVE-2026-88778)","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","author":"Citrix","date":"2026-09-27"},{"title":"CISA KEV entry for CVE-2026-88771","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","author":"CISA","date":"2026-09-27"}],"amIAffected":{"summary":"NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1-FIPS before 14.1-73.37 FIPS, and 13.1-FIPS/NDcPP before 13.1-37.279 are in scope. CVE-2026-88771 applies to default configurations. Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are also in scope. CTX697096 applies to customer-managed appliances; Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication.","checks":[{"id":"v2s-aia-citrix-netscaler-cve-2026-88771-version-1","kind":"version","title":"Read the NetScaler build against the first-fixed releases","detail":"CTX697096: 14.1 BEFORE 14.1-73.37; 13.1 BEFORE 13.1-64.23; Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS; Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279. Record the NS build from the GUI System Information view or the build string at the top of a saved ns.conf.","command":"In the NetScaler GUI System Information view, or the build string at the top of a saved ns.conf, record the NS version (for example 14.1-73.37) and compare it to CTX697096 first-fixed builds.","affectedMeans":"14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1-FIPS before 14.1-73.37 FIPS, or 13.1-FIPS/NDcPP before 13.1-37.279.","fixedMeans":"14.1-73.37 or later, 13.1-64.23 or later, 14.1-FIPS 14.1-73.37 FIPS or later, or 13.1-FIPS/NDcPP 13.1-37.279 or later. Citrix-managed cloud and Adaptive Authentication are vendor-managed.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"}]},{"id":"v2s-aia-citrix-netscaler-cve-2026-88771-config-2","kind":"config","title":"CVE-2026-88771 has no extra feature precondition","detail":"CTX697096: all NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration. No additional features or settings need to be enabled. Version is the decision.","command":"Treat every customer-managed ADC or Gateway below a CTX697096 first-fixed build as in scope for CVE-2026-88771, including default-config appliances.","affectedMeans":"A customer-managed ADC or Gateway on a build below the first-fixed release for that train, including default configuration.","fixedMeans":"The appliance is on a first-fixed build, or it is Citrix-managed cloud / Adaptive Authentication (vendor-managed).","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"}]}],"limits":["CVE-2026-88771 does not require an extra feature flag. A default-config appliance on a vulnerable build is in scope.","Citrix lists no workaround for this CVE in CTX697096. The bulletin's TCP configuration change is for CVE-2026-88778, not this CVE.","Citrix-managed cloud and Adaptive Authentication are vendor-managed, not a statement about customer-owned appliances."],"sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"}],"updatedAt":"2026-11-09","addedDate":"2026-11-09"},"mitigations":{"summary":"CTX697096 tells customers to install a fixed build for CVE-2026-88771. The bulletin's TCP configuration change is for CVE-2026-88778, not this CVE. CISA KEV tells you to apply vendor instructions or discontinue use. Patch is the only vendor fix for CVE-2026-88771.","items":[],"nonePublished":{"statement":"No vendor mitigation published; patch is the only fix","checkedDate":"2026-11-09","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}]},"updatedAt":"2026-11-09","addedDate":"2026-11-09"},"response":{"summary":"Install a CTX697096 fixed build. CISA KEV requires forensic triage and points at Console IoCs. If the appliance was internet-exposed on a vulnerable build, hunt from 27 Sep 2026 as far as retention allows.","containment":[{"title":"Install a fixed NetScaler build","detail":"CTX697096: 14.1-73.37 or later, 13.1-64.23 or later, 14.1-FIPS 14.1-73.37 FIPS or later, or 13.1-FIPS/NDcPP 13.1-37.279 or later. CISA KEV due date 30 Sep 2026: apply vendor instructions, follow BOD 26-04 for cloud services, or discontinue use if mitigations are unavailable.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}]},{"title":"Run Console IoC checks","detail":"CISA KEV: running the provided IoCs in the NetScaler console may help identify indicators of exploitation. Forensic triage is required.","sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}]}],"rotate":[{"item":"Credentials, sessions, and secrets stored on or behind the Gateway","reason":"CISA KEV requires forensic triage for this CVE. No CVE-2026-88771-specific rotate list was published in CTX697096.","generic":true,"sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}]}],"evidence":[{"title":"Keep the pre-upgrade ns.conf and build string","detail":"CTX697096 uses the build string to decide whether the appliance is below a first-fixed release. Preserve a copy taken before the upgrade.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"}]},{"title":"Console IoC scan output","detail":"Keep Security Advisory scan results. CISA KEV points at those IoCs.","sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}]}],"limits":["CTX697096 publishes no CVE-2026-88771-specific file-hash list and no workaround for this CVE.","CVE-2026-88772 is a different bug. Do not use its DTLS precondition as a CVE-2026-88771 clearance."],"sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-27","publisher":"CISA"}],"updatedAt":"2026-11-09","addedDate":"2026-11-09"},"bulletins":[{"vendor":"Citrix","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","cve":"CVE-2026-88771"}],"coverage":[{"title":"CTX697096 Security Bulletin","publisher":"Citrix","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","date":"2026-09-27","type":"vendor","addedDate":"2026-11-09"},{"title":"CISA KEV entry for CVE-2026-88771","publisher":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","date":"2026-09-27","type":"government","addedDate":"2026-11-09"},{"title":"NVD CVE-2026-88771","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","date":"2026-09-27","type":"government","addedDate":"2026-11-09"},{"title":"Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more","publisher":"Rapid7","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","date":"2026-11-06","type":"research","addedDate":"2026-11-09"}],"posts":[],"research":[{"title":"CTX697096 Security Bulletin","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","authors":"Citrix","date":"2026-09-27"},{"title":"NVD CVE-2026-88771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88771","authors":"NVD","date":"2026-09-27"},{"title":"Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","authors":"Jack Heysel; module credits CERT-EU, Scyrix LLC, sfewer-r7, and watchTowr","date":"2026-11-06"}],"impact":{"kind":"single-product","product":"Citrix NetScaler ADC and NetScaler Gateway","versions":[{"version":"NetScaler ADC and Gateway 14.1 (all deployments, including default)","status":"affected","versions":">= 14.1-73.37","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37"},"addedDate":"2026-11-09"},{"version":"NetScaler ADC and Gateway 13.1 (all deployments, including default)","status":"affected","versions":">= 13.1-64.23","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23"},"addedDate":"2026-11-09"},{"version":"NetScaler ADC 14.1-FIPS (all deployments, including default)","status":"affected","versions":">= 14.1-73.37 FIPS","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS"},"addedDate":"2026-11-09"},{"version":"NetScaler ADC 13.1-FIPS and 13.1-NDcPP (all deployments, including default)","status":"affected","versions":">= 13.1-37.279","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279"},"addedDate":"2026-11-09"},{"version":"Secure Private Access Hybrid (customer-managed NetScaler)","status":"affected","versions":"Upgrade the NetScaler instance to a CTX697096 fixed build","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities."},"addedDate":"2026-11-09"},{"version":"Citrix-managed cloud / Adaptive Authentication","status":"vendor-managed-no-action","vendorStatement":{"date":"2026-09-27","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","quote":"This bulletin only applies to customer-managed Citrix NetScaler ADC (“NetScaler ADC”) and Citrix NetScaler Gateway (“NetScaler Gateway”). Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates."},"addedDate":"2026-11-09"}]},"pocs":[{"title":"Metasploit Framework 6.5.9 NetScaler login-log command injection module (for defenders)","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more/","source":"Rapid7 / sfewer-r7","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-06","notes":"Listed for defenders. Rapid7-reported module in the 6 Nov 2026 wrap-up. Rapid7 lists the module under CVE-2026-88771; the wrap-up CVE reference field is CVE-2026-88773. No definitive module-to-CVE label. The wrap-up names no lab build. Unverified. This site does not republish exploit code, payloads, or usage commands.","addedDate":"2026-11-09"}],"pocEmptyState":"Rapid7's 6 Nov 2026 wrap-up module is indexed as unverified. Rapid7 lists it under CVE-2026-88771; the wrap-up CVE reference field is CVE-2026-88773. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/citrix-netscaler-cve-2026-88771","json":"https://vuln2shell.com/vulns/citrix-netscaler-cve-2026-88771.json","iocsCsv":"https://vuln2shell.com/vulns/citrix-netscaler-cve-2026-88771/iocs.csv","stix":"https://vuln2shell.com/vulns/citrix-netscaler-cve-2026-88771/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public PoC (unverified RCE)"}}}