Details
- Type
- Command Injection
- Impact
- Remote Code Execution
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 27 September 2026
- Updated
- 15 October 2026
- Weakness
- CWE-20
Vendor fix
Upgrade to versions 14.1-73.37 or later and 13.1-64.23 or later.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-88771
- https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg
- https://asec.ahnlab.com/en/95733/
- https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
- https://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771
- https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
- https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2026-88771
- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators
- https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
- https://www.recordedfuture.com/blog/september-2026-cve-landscape
- https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771