CVE-2026-88771 – Citrix NetScaler ADC
“When the front door of your network is under live attack, every unpatched appliance is an open invitation.”
This update fixes five vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, the appliances that sit at the edge of the network and handle remote access. CVE-2026-88771 has a CVSS score of 9.5, Critical severity. It is an improper input validation flaw that lets an unauthenticated attacker execute arbitrary commands. CVE-2026-88772 has a CVSS score of 9.5, Critical severity, and leads to remote code execution or denial of service. CVE-2026-88773 has a CVSS score of 9.3, Critical severity, and is an HTTP request smuggling flaw. CVE-2026-107406 has a CVSS score of 9.5, Critical severity. It is a memory overflow that leads to remote code execution or denial of service on appliances configured as a SAML SP or SAML IdP. CVE-2026-88779 has a CVSS score of 8.7, High severity.
Attackers are actively exploiting CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779. All supported 14.1, 13.1 and FIPS/NDcPP builds are affected. CVE-2026-107406 also affects some recently fixed 14.1 and 13.1 builds when they run as a SAML IdP, so systems that took the earlier fix still need this update. Update every NetScaler ADC and Gateway appliance now.
Key Details
- Affected Product
- Citrix Netscaler Application Delivery Controller
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-20