CNNVD Alerts on Citrix NetScaler ADC Input Validation Flaw CVE-2026-88771
China's National Computer Network Vulnerability Database reported an input validation flaw in Citrix NetScaler Application Delivery Controller tracked as CNNVD-2026-87241110 and CVE-2026-88771. Unauthenticated attackers can send malicious network requests to affected appliances and execute arbitrary code, and Citrix has released patched versions.
Vulnerability
China's National Computer Network Vulnerability Database (CNNVD) has published a bulletin on an input validation error in Citrix NetScaler Application Delivery Controller, tracked as CNNVD-2026-87241110 and CVE-2026-88771. An unauthenticated attacker can send malicious requests over the network to a target device and execute arbitrary code. Multiple Citrix versions are affected. Citrix has released new versions that fix the issue. CNNVD advised users to confirm product versions and apply patches promptly.
Citrix NetScaler Application Delivery Controller is an application delivery and load balancing product from Citrix. It is used for application traffic management, load balancing, application acceleration, and security protection. CNNVD said the flaw comes from improper input validation. An unauthenticated attacker can send malicious requests over the network to an affected device and execute arbitrary commands.
Affected products and versions
The bulletin lists these affected ranges:
- Citrix NetScaler Application Delivery Controller 14.1 before 14.1-73.37
- Citrix NetScaler Application Delivery Controller 13.1 before 13.1-64.23
- FIPS builds before 14.1-73.37
- FIPS builds before 13.1.37.279
- NDcPP builds before 13.1.37.279
- Citrix NetScaler Gateway 14.1 before 14.1-73.37
- Citrix NetScaler Gateway 13.1 before 13.1-64.23
Impact
The issue allows unauthenticated remote execution of arbitrary code or commands on the appliance. CNNVD did not assign a CVSS score in this notice. Devices running the listed NetScaler ADC and Gateway versions are affected.
Patching
Citrix has published fixed builds. CNNVD recommends that users inventory NetScaler ADC and Gateway deployments, including FIPS and NDcPP variants, and install the vendor update. The official reference is:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Technical support for the bulletin came from CNNVD partner units, including Qi-Anxin NetShen Information Technology (Beijing) Co., Ltd. and the Central China Evaluation Center of the China Information Technology Security Evaluation Center. CNNVD said it will keep tracking the vulnerability and will publish further information as needed. Contact: cnnvd@itsec.gov.cn