NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation

CVE-2026-88771 is an improper input validation flaw (CWE-20) in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to execute arbitrary commands. It is reachable over the network with low complexity, though the CVSS vector notes a precondition, and successful exploitation has high impact on confidentiality, integrity, and availability of the appliance and of systems beyond it. Affected ADC builds are those before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; affected Gateway builds are those before 14.1-73.37 and before 13.1-64.23. Related reporting says Citrix confirmed NetScaler RCE flaws were exploited as zero-days. No public proof-of-concept is known, and the CVE is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23 or later, and move FIPS and NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP or later. Because active exploitation is reported, treat unpatched internet-facing appliances as potentially compromised: review logs for unexpected commands or configuration changes, rotate credentials and session material, and restrict Gateway and management exposure until patched.