CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. Exploitation requires no optional features to be enabled.Citrix confirmed exploitation on unmitigated appliances, and the US’s Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 to its Known Exploited Vulnerabilities
- Vendor
- Citrix
- Product
- NetScaler ADC / Gateway
- CVSS v3.1
- 9.8
- EPSS
- 0.82 (p100)
- Exploitation
- observed in the wild
- Exposure class
- Edge / VPN / firewall
Why it ranks 92 (Critical)
- Exploitation observed in the wild
- CVSS v3.1 9.8 critical
- EPSS 0.82 (high probability of exploitation)
- Exposed product class: edge / VPN / firewall
- Widely deployed vendor product (Citrix)
- Covered by 13 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Zscaler ThreatLabz (zscaler.com)
- CVE-2026-88771 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-107406 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-75650 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.