Citrix NetScaler Command Injection CVE-2026-88771 Rated CVSS 9.8
Citrix patched unauthenticated command injection CVE-2026-88771 in NetScaler ADC and Gateway on 27 September 2026, with a CVSS 3.1 score of 9.8. QiAnXin counted 10,450 at-risk assets in China and 84,069 globally and said in-the-wild exploitation had been observed.
Advisory snapshot
QiAnXin CERT reported on 29 September 2026 that Citrix had fixed a command-injection vulnerability in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 and QVD-2026-73943. The vendor fix was recorded as public on 27 September 2026. QiAnXin rated the issue high, assigned a CVSS 3.1 score of 9.8, and classed the threat type as command injection.
The advisory stated that successful abuse can fully compromise an appliance, expose configuration files and credentials, and interrupt services. QiAnXin also stated that in-the-wild exploitation had been observed and that the affected population is in the tens of thousands. Customers were told to inventory devices and install the patched builds listed below.
Citrix NetScaler ADC is an application delivery controller used at data-center and cloud edges for load balancing, SSL offload, application acceleration, and web application firewall functions. NetScaler Gateway provides SSL VPN remote access and unified authentication to internal resources, virtual desktops, and SaaS applications. The products are used in finance, healthcare, telecommunications, and government networks.
Official patch notes are in Citrix article CTX697096: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Impact
CVE-2026-88771 is an unauthenticated command-injection flaw. QiAnXin said a successful attack can run commands with root privileges on the appliance, bypass authentication, take over the device, disclose configuration and credentials, and disrupt dependent applications. Default deployments are in scope. No separate exploit conditions beyond a reachable, unpatched device were listed as required.
QiAnXin scored exploit likelihood as high. This dispatch does not include exploitation methods, payloads, or reproduction notes. Operators should treat the CVSS 9.8 score, the in-the-wild report, and the version list as the basis for patching priority.
Affected versions
The following builds are listed as vulnerable:
- Citrix NetScaler ADC / Citrix NetScaler Gateway 14.1 earlier than 14.1-73.37
- Citrix NetScaler ADC / Citrix NetScaler Gateway 13.1 earlier than 13.1-64.23
- Citrix NetScaler ADC 14.1-FIPS earlier than 14.1-73.37 FIPS
- Citrix NetScaler ADC 13.1-FIPS / 13.1-NDcPP earlier than 13.1-37.279
Fixed versions
Citrix published patches. Upgrade to one of the following or later:
- NetScaler ADC / NetScaler Gateway 14.1-73.37
- NetScaler ADC / NetScaler Gateway 13.1-64.23
- NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS
- NetScaler ADC 13.1-FIPS / 13.1-NDcPP 13.1-37.279
Exposed assets
QiAnXin’s Eagle Map asset survey tied CVE-2026-88771 to 10,450 at-risk assets in China and 875 related IP addresses. Globally it tied the same CVE to 84,069 at-risk assets and 6,616 related IP addresses. Those counts are survey totals, not confirmed compromises.
Patching and hardening
The primary action is to install the builds in CTX697096. Until that is complete, QiAnXin recommended reducing internet exposure of the NetScaler management plane (NSIP) and of AAA/Gateway virtual servers, and restricting management access to known source IP addresses.
If an upgrade cannot be applied immediately, schedule a maintenance-window security review of the appliance after the patch is staged. Replace any device that cannot be upgraded to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 as applicable.
Reference: Citrix CTX697096, https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096