Attackers exploit Citrix NetScaler RCE CVE-2026-88771
Original title: Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Unauthenticated attackers poison logs, plant web shells and try to run a FreeBSD implant; CISA listed the flaw.
Citrix NetScaler ADC and Gateway appliances are under active attack through CVE-2026-88771, an unauthenticated remote code execution flaw that needs no optional features. Citrix disclosed it on September 27, 2026, with a CVSS v4.0 score of 9.5, and CISA added it to the Known Exploited Vulnerabilities catalog. ThreatLabz saw log poisoning, web shells and attempts to deploy a Rust FreeBSD x64 binary. Citrix has published fixed builds for affected branches.
Unconfirmed: Observed deployment attempts do not prove every targeted appliance was compromised, and shared hosting does not establish one actor for both campaigns.
- Fixed builds include 14.1-73.37 and later and 13.1-64.23 and later.
- FIPS and NDcPP fixes include 14.1-73.37 FIPS and later and 13.1.37.279.
- Payload hosting overlapped infrastructure tied to CVE-2026-75650, without confirmed shared operators.
- A separate SAML issue, CVE-2026-107406, has its own fixed builds, including 14.1-73.46 and 13.1-64.29.
Impact: Unauthenticated remote command execution on NetScaler appliances
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC and Gateway | — | 14.1-73.37 and later; 13.1-64.23 and later; 14.1-73.37 FIPS and later; 13.1.37.279 for FIPS and NDcPP |
- 1.Install the vendor-recommended fixed build for the applicable branch.
- 2.Preserve logs, support bundles and core dumps before updating suspected appliances.
- 3.If compromise is confirmed, rotate credentials and secrets reachable through the appliance.
- CVEs
- CVE-2026-88771
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059 Command and Scripting Interpreter
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88771 | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.153.212.101 | r secrets accessible through the appliance. IOCs Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[ |
| ipv4 | 46.233.40.20 | ble through the appliance. IOCs Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119 Note: IP |
| ipv4 | 46.236.167.143 | appliance. IOCs Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119 Note: IP addresses and dom |
| ipv4 | 46.33.33.95 | Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119 Note: IP addresses and domains are inten |
| ipv4 | 49.150.197.119 | 153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119 Note: IP addresses and domains are intentionally defanged |
From the original article
3 min read at gbhackers.com
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026, […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.