By @watchtowrcyber
Publication Date: 2026-09-27 21:24:00
Key Facts
- CVE: CVE-2026-88771
- CVSS: 9.5 Critical (CVSS 4.0)
- Exploited in the wild: Yes, reported by CISA KEV (added September 27, 2026) and watchTowr
- Fix available: Yes
- Last updated: September 28, 2026
What Are CVE-2026-88771 and CVE-2026-88772?
CVE-2026-88771 and CVE-2026-88772 are remote code execution vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that attackers exploited as zero-days, before a fix existed. Citrix confirmed both and released fixed builds on September 27, 2026 in security bulletin CTX697096.
- CVE-2026-88771 is an improper input validation vulnerability that lets an unauthenticated attacker run arbitrary commands on the appliance. It affects every NetScaler ADC and NetScaler Gateway deployment on an affected version, including the default configuration. No special feature needs to be enabled.
- CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled. DTLS is on by default for VPN virtual…
