CVE-2026-88774
published 2026-09-27CVE-2026-88774: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and…
PriorityP343high7.2CVSS 3.1
AVNACLPRNUINSCCLILAN
EPSS
0.40%
33.4th percentile
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_adm | — | — |
| citrix | citrix_endpoint_management | — | — |
| citrix | citrix_hypervisor | — | — |
| citrix | citrix_netscaler_adc | — | — |
| citrix | citrix_netscaler_gateway | — | — |
| citrix | citrix_virtual_apps_and_desktops | — | — |
| citrix | citrix_workspace_app | — | — |
| citrix | endpoint_management | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_application_delivery_controller | >= 13.1 < 13.1-64.23 | 13.1-64.23 |
| citrix | netscaler_application_delivery_controller | >= 13.1 < 13.1.37.279 | 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | >= 14.1 < 14.1-73.37 | 14.1-73.37 |
| citrix | netscaler_application_delivery_controller | 14.1-66.68 – 14.1-73.37 | — |
| citrix | netscaler_gateway | — | — |
| citrix | netscaler_gateway | >= 13.1 < 13.1-64.23 | 13.1-64.23 |
| citrix | netscaler_gateway | >= 14.1 < 14.1-73.37 | 14.1-73.37 |
| citrix | xenmobile | — | — |
| citrix | xenserver | — | — |
| citrix_netscaler | adc | < 14.1-73.37 | 14.1-73.37 |
| citrix_netscaler | adc | < 13.1-64.23 | 13.1-64.23 |
| citrix_netscaler | adc | < 14.1-73.37 FIPS | 14.1-73.37 FIPS |
| citrix_netscaler | adc | < 13.1.37.279 FIPS and NDcPP | 13.1.37.279 FIPS and NDcPP |
| citrix_netscaler | gateway | < 14.1-73.37 | 14.1-73.37 |
| citrix_netscaler | gateway | < 13.1-64.23 | 13.1-64.23 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
nvdv4.07.0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Citrix
Citrix Security Bulletin CTX697174
vendor_citrix·CVSS 8.8
CVE-2026-19489 [HIGH] Citrix Security Bulletin CTX697174
Citrix Security Bulletin CTX697174
CVE References: CVE-2026-19489, CVE-2026-19490, CVE-2026-78546, CVE-2026-78547, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace app, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697181
vendor_citrix·CVSS 6.5
CVE-2026-102700 [MEDIUM] Citrix Security Bulletin CTX697181
Citrix Security Bulletin CTX697181
CVE References: CVE-2026-102700, CVE-2026-102701, CVE-2026-107406, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-84419, CVE-2026-84420, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace App, Endpoint Management, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697187
vendor_citrix·CVSS 6.5
CVE-2026-102700 [MEDIUM] Citrix Security Bulletin CTX697187
Citrix Security Bulletin CTX697187
CVE References: CVE-2026-102700, CVE-2026-102701, CVE-2026-107406, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-84419, CVE-2026-84420, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace App, Endpoint Management, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697096
vendor_citrix·CVSS 8.8
CVE-2026-19489 [HIGH] Citrix Security Bulletin CTX697096
Citrix Security Bulletin CTX697096
CVE References: CVE-2026-19489, CVE-2026-19490, CVE-2026-42491, CVE-2026-78546, CVE-2026-78547, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace app, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
GHSA
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
ghsa_unreviewed·2026-09-27
CVE-2026-88774 [HIGH] Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
VulDB
Citrix ADC/Gateway Feature Policy privileges management
vuldb·2026-09-27·CVSS 7.0
CVE-2026-88774 [HIGH] Citrix ADC/Gateway Feature Policy privileges management
A vulnerability classified as critical has been found in Citrix ADC and Gateway. This affects an unknown function of the component Feature Policy. Performing a manipulation results in improper privilege management.
This vulnerability was named CVE-2026-88774. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
Rapid7
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
blogs_rapid7·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
## Overview
On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772 . Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure .
CVE-2026-88771 affects vulnerable NetScaler deployments in their default configuration, with no additional product features required. The vendor has also indicated that the attack complexity for exploiting CVE-2026-88771 is low, meaning reliable RCE is likely against all vulnerable NetScaler appliances regardless of their configuration. This is especially concerning due to the pr
Unit42
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
blogs_unit42·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
## Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Unit 42
Published: September 28, 2026
High Profile Threats
Vulnerabilities
Citrix Netscaler
Denial of service
Remote Code Execution
Zero-day
## Executive Summary
Unit 42 is aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. As of Sept. 27, 2026, Palo Alto Networks Cortex Xpanse has identified 50,277 exposed instances that could potentially be vulnerable to these CVEs based on our telemetry.
CVE-2026-88771 is a remote code execution (RCE) vulnerability that fails to properly validate input and allows an unauthenticated actor to run commands against NetScaler ADC and NetScaler Gateway syst
Hackernews
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
blogs_hackernews·2026-09-27·CVSS 9.5
CVE-2026-88771 [CRITICAL] Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six other flaws. One of the two affects every deployment on an affected version, including those in the default configuration.
The bulletin came a day after security firm watchTowr said two unpatched NetScaler RCE flaws had been exploited, and after some administrators said they had taken appliances offline. Citrix did not say whether i
NCSC
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
ncsc·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
News Download & print article PDF Download & print article PDF
## Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
## What has happened?
Citrix has published a security bulletin detailing eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being actively exploited.
The NCSC is working to understand the impact of these vulnerabilities on UK organisations.
- CVE-2026-88771: Improper input validation allowing an unauthenticated remote attacker to execute arbitrary commands.
- CVE-2026-88
2026-09-27
Published