CVE-2026-88771: A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Other sources
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Citrix NetScaler ADC and NetScaler Gatewayto a version that resolves this vulnerability.Fixed in 14.1-73.37 - Upgrade
Upgrade
Citrix NetScaler ADC and NetScaler Gatewayto a version that resolves this vulnerability.Fixed in 13.1-64.23 - Upgrade
Upgrade
Citrix NetScaler ADC FIPSto a version that resolves this vulnerability.Fixed in 14.1-73.37 - Upgrade
Upgrade
Citrix NetScaler ADC FIPS and NDcPPto a version that resolves this vulnerability.Fixed in 13.1.37.279 - Compensating control
Discontinue use of Citrix NetScaler ADC and NetScaler Gateway if mitigations are unavailable.
Event History
Frequently Asked Questions
Which deployments are affected?
Affected Citrix NetScaler ADC deployments are versions earlier than 14.1-73.37 or 13.1-64.23, including ADC FIPS versions earlier than 14.1-73.37 FIPS and 13.1.37.279 FIPS and NDcPP. Citrix NetScaler Gateway deployments earlier than 14.1-73.37 or 13.1-64.23 are also affected.
Does exploitation require authentication?
No. An unauthenticated attacker can exploit the improper input validation issue to execute arbitrary commands.
What versions address the issue?
Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.37 or later, or 13.1-64.23 or later. For ADC FIPS and NDcPP deployments, use 14.1-73.37 FIPS or later, or 13.1.37.279 FIPS and NDcPP or later.