CVE-2026-88771

NetScaler is like the front door and traffic cop for a company's network, deciding who gets in and routing data to the right place. This flaw lets an outsider walk straight through that door without a key and give the device commands as if they owned it — potentially taking over everything behind it.

This matters to you if you run Citrix NetScaler ADC or NetScaler Gateway, commonly used for remote access or load balancing in front of business applications. It affects internet-facing devices directly — no login or employee action is needed for an attacker to exploit it.

Attackers are already exploiting this vulnerability in real-world attacks, and it's on the official U.S. government list of actively exploited threats with an urgent fix deadline. This is as serious as it gets — treat it as an active emergency, not a routine update.

1. Identify all NetScaler ADC and NetScaler Gateway instances and record their current build/version. 2. Confirm exposure: any instance reachable from the internet (especially management or gateway interfaces) is at highest risk and should be prioritized. 3. Upgrade to fixed builds per branch: 14.1-73.37 (standard and FIPS) for the 14.1 line; 13.1-64.23 for the 13.1 standard line; 13.1.37.279 for FIPS and NDcPP builds. 4. Follow Citrix's official upgrade guidance at CTX697096, noting any version-specific upgrade path requirements (e.g., sequential upgrades may be needed from very old builds). 5. If patching cannot happen before the CISA KEV due date of 2026-09-30, restrict network exposure (block internet access to management interfaces, enforce VPN/allowlist access) as an interim measure, and follow CISA BOD 26-04 guidance, including forensic triage if compromise is suspected. 6. After patching, monitor logs for unusual authentication bypass attempts, unexpected command execution, or new admin accounts/config changes as indicators of prior compromise.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. Weakness class is CWE-20 (Improper Input Validation) enabling unauthenticated arbitrary command execution. Confirmed active exploitation per CISA KEV (added 2026-09-27, due 2026-09-30); no public exploit code/PoC is currently on record, suggesting exploitation is being driven by threat actors with private tooling rather than widely available scripts. EPSS prediction is not used here since confirmed KEV exploitation supersedes it.