CVE-2026-88771 Exploitation Attempts Observed — Citrix NetScaler

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-88771 is an unauthenticated vulnerability affecting Citrix NetScaler ADC, Gateway. Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Have exploitation attempts been observed?

Yes. Previdian sensors have observed 557 exploitation attempts, 56 unique attacker IPs, and 18 countries targeting CVE-2026-88771. First observed Sep 29, 2026; last observed Nov 14, 2026. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Citrix NetScaler / ADC and Gateway, including affected before 14.1-73.37, affected before 13.1-64.23, and affected before 14.1-73.37 FIPS.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Vendor Product Affected Status

Citrix NetScaler Affected

ADC

Before 14.1-73.37 Before 13.1-64.23 Before 14.1-73.37 FIPS Before 13.1.37.279 FIPS and NDcPP

Affected

Citrix NetScaler Affected

Gateway

Before 14.1-73.37 Before 13.1-64.23

Affected

Published: 27 Sep 2026
Exploitation Attempts Reported: 27 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-88771
support.citrix.com/support-home/kbsearch/article support.citrix.com · CVE Record https://support.citrix.com/support-home/kbsearch/article?articleNumbe...

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

Citrix

Recorded 27 Sep 2026

A trusted third party reported exploitation attempts.

Exploitation Attempts Observed

Previdian sensor

First observed 29 Sep 2026

Previdian sensors observed exploitation attempts targeting this vulnerability.

Proof of concept available

GitHub

Recorded 27 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Citrix First	2026-09-27 16:44 UTC
CVE	2026-09-27 20:40 UTC
Tenable Blog	2026-09-27 21:21 UTC
CISA	2026-09-27 21:50 UTC
The Hacker News	2026-09-28 07:30 UTC
SOCRadar	2026-09-28 08:20 UTC
CERT Polska	2026-09-28 08:21 UTC
Security Affairs	2026-09-28 10:21 UTC
Rapid7	2026-09-28 10:21 UTC
watchTowr	2026-09-28 11:20 UTC
NCSC Alerts and Advisories	2026-09-28 12:20 UTC
Palo Alto Unit42	2026-09-28 15:21 UTC
Qualys ThreatPROTECT	2026-09-28 16:20 UTC
GreyNoise	2026-09-28 17:21 UTC
The Shadowserver	2026-09-29 00:00 UTC
Google Threat Intelligence	2026-09-29 14:21 UTC
Arctic Wolf	2026-10-02 17:21 UTC
Previdian Sensors	2026-10-05 12:05 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

Previdian Sensor Observations

Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded. The cards and chart show volume, unique attackers, and daily activity.

557

Attempts observed

56

Unique attacker IPs

18

Attacker countries

BG · CN · CO · DE · HK · IN · JP · KR · LV · ML · NL · PA · RU · SC · SG · TW · UA · US

10

Sensors observed

CVE-2026-88771 exploitation attempts over the last 48 days

Daily events observed by Previdian sensors

Updated 14 Nov 2026

0

1

4

0

4

3

72

64

12

42

23

8

4

1

13

9

10

9

32

8

0

47

0

39

32

0

3

2

29

0

21

1

0

4

8

7

0

4

1

2

8

7

0

10

3

28 Sep 8 Oct 18 Oct 28 Oct 14 Nov

First observed 29 Sep 2026 · Last observed 14 Nov 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 17; 18; 20

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

Metasploit template detected 27 Sep 2026.

View Metasploit template

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb	27 Sep 2026

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

9.5 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS

81.9%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Input Validation CWE-20

Recent mention · Rapid7

06 Nov 2026

Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more

Read full advisory

All CVSS Scores

CVSS v4.0 9.5 Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All Mentions

Recent mention · NCSC Security Advisories

NCSC-2026-0394 [1.00] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway

NCSC Security Advisories · 27 Sep 2026

Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar: - Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 vóór versie 14.1-73.37 - Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 vóór versie 13.1-64.23 - Citrix NetScaler ADC FIPS vóór versie 14.1-73.37 FIPS - Citrix NetScaler ADC FIPS en NDcPP vóór versie 13.1-37.279 Secure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden. Deze...

Recent mention · Citrix

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778

Citrix · 27 Sep 2026

Guidance for customers on newly addressed vulnerabilities and recommended updates As the cybersecurity landscape continues to evolve, organizations across the industry are seeing changes in the pace, scale, and complexity of vulnerability research, discovery, and analysis. AI-assisted research and automation may contribute to this shift by enabling faster identification and validation of certain classes of security issues. Citrix continues to invest in secure development, security testing, coordinated disclosure, and vulnerability response processes. Citrix has released updates for...

Recent mention · CERT Polska

Podatności 0-day w urządzeniach Citrix NetScaler

CERT Polska · 27 Sep 2026

Zespół CERT Polska informuje o dwóch podatnościach 0-day w urządzeniach Citrix NetScaler, które są aktywnie wykorzystywane do ataków.Na podstawie dostępnych informacji należy założyć, że podatności umożliwiają zdalnemu, nieuwierzytelnionemu atakującemu wykonanie dowolnego kodu na urządzeniu. Szczegóły techniczne nie zostały jeszcze ujawnione, a producent nie opublikował aktualizacji bezpieczeństwa.Z uwagi na aktywnie wykorzystywane luki i brak dostępnej poprawki, rekomendujemy odłączenie urządzeń NetScaler od Internetu oraz śledzenie oficjalnych komunikatów producenta.Biuletyny...

Recent mention · Tenable Blog

Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

Tenable Blog · 27 Sep 2026

CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026.Change logUpdate September 27: Citrix published security bulletin CTX697096, confirming CVE-2026-88771 and CVE-2026-88772 as the two zero-day RCE vulnerabilities and releasing patches. Post updated with CVE IDs, CVSS scores, patch versions, and IoC guidance.Click here to review the change log historyUpdate September 27: Citrix published security bulletin CTX697096, confirming CVE-2026-88771 and CVE-2026-88772 as the...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

github · Created 2026-09-27 18:15:38 UTC · 0 stars · AI assessment 85%

Timeline

From disclosure to observed exploitation attempts

02 Oct 2026
17:21 UTC

KEV confirmed by Arctic Wolf

Exploitation attempts reported by an external source
29 Sep 2026
14:21 UTC

KEV confirmed by Google Threat Intelligence

Exploitation attempts reported by an external source
29 Sep 2026
01:02 UTC

Indicators of compromise added (56)

Indicators of compromise recorded
29 Sep 2026
01:02 UTC

Observed by Previdian sensors

Previdian sensors observed exploitation attempts targeting this vulnerability.
29 Sep 2026
00:00 UTC

KEV confirmed by The Shadowserver

Exploitation attempts reported by an external source
28 Sep 2026
17:21 UTC

KEV confirmed by GreyNoise

Exploitation attempts reported by an external source
28 Sep 2026
16:20 UTC

KEV confirmed by Qualys ThreatPROTECT

Exploitation attempts reported by an external source
28 Sep 2026
15:21 UTC

KEV confirmed by Palo Alto Unit42

Exploitation attempts reported by an external source
28 Sep 2026
12:20 UTC

KEV confirmed by NCSC Alerts and Advisories

Exploitation attempts reported by an external source
28 Sep 2026
11:20 UTC

KEV confirmed by watchTowr

Exploitation attempts reported by an external source
28 Sep 2026
10:21 UTC

KEV confirmed by Rapid7

Exploitation attempts reported by an external source
28 Sep 2026
10:21 UTC

KEV confirmed by Security Affairs

Exploitation attempts reported by an external source
28 Sep 2026
08:21 UTC

KEV confirmed by CERT Polska

Exploitation attempts reported by an external source
28 Sep 2026
08:20 UTC

KEV confirmed by SOCRadar

Exploitation attempts reported by an external source
28 Sep 2026
07:30 UTC

KEV confirmed by The Hacker News

Exploitation attempts reported by an external source
27 Sep 2026
21:50 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
27 Sep 2026
21:21 UTC

KEV confirmed by Tenable Blog

Exploitation attempts reported by an external source
27 Sep 2026
20:40 UTC

KEV confirmed by CVE

Exploitation attempts reported by an external source
27 Sep 2026
18:15 UTC

Public PoC available

Public proof-of-concept code published
27 Sep 2026
16:44 UTC

Added to Previdian KEV Feed

High-confidence, third-party report of exploitation attempts
27 Sep 2026
16:02 UTC

CVE published

Vulnerability disclosed publicly
27 Sep 2026
00:00 UTC

Metasploit module available

Exploit module available
10 Sep 2026
07:14 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-88771

Sample API response

{
  "cve_id": "CVE-2026-88771",
  "confidence": "Confirmed",
  "cvss_score": 9.5,
  "cvss_estimated": false,
  "epss_score": 0.81894,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 557, "sensors": 10 }
}

CVE-2026-88771

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway

Tags

CVE References

Exploitation Attempts Observed in the Wild

Exploitation Attempts Observed

Proof of concept available

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Attacker IP Indicators

Scanner Artifacts

Weaknesses

Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more

All CVSS Scores

All Mentions

Potential Proof of Concepts

KEV confirmed by Arctic Wolf

KEV confirmed by Google Threat Intelligence

Indicators of compromise added (56)

Observed by Previdian sensors

KEV confirmed by The Shadowserver

KEV confirmed by GreyNoise

KEV confirmed by Qualys ThreatPROTECT

KEV confirmed by Palo Alto Unit42

KEV confirmed by NCSC Alerts and Advisories

KEV confirmed by watchTowr

KEV confirmed by Rapid7

KEV confirmed by Security Affairs

KEV confirmed by CERT Polska

KEV confirmed by SOCRadar

KEV confirmed by The Hacker News

Added to CISA KEV

KEV confirmed by Tenable Blog

KEV confirmed by CVE

Public PoC available

Added to Previdian KEV Feed

CVE published

Metasploit module available

CVE ID reserved

Automate this intelligence