CVE-2026-88771 · Low · CISA KEV

Citrix NetScaler Improper Input Validation: Unauthenticated RCE, CISA KEV Listed

Threat Engine Auto-Feed · data current as of 2026-09-28

A critical improper input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated attackers to execute arbitrary commands. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Organizations using affected NetScaler products are at immediate risk.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from improper input validation, meaning the software does not correctly check or sanitize data provided by users or external systems. An attacker can submit specially crafted input that the system misinterprets, leading to unintended and potentially malicious actions, such as executing arbitrary commands.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Citrix NetScaler ADC or NetScaler Gateway for network traffic management, load balancing, or secure remote access.
  • Financial services organizations, due to documented targeting by financially motivated actors like FIN7, LockBit affiliates, and APT38.
  • Technology sector organizations, due to documented targeting by state-sponsored groups like APT29 and financially motivated groups like Scattered Spider.

Misconfigurations that escalate it

  • Any configuration that exposes NetScaler ADC or Gateway instances to untrusted networks without robust compensating controls.

High-impact scenarios

  • Unauthenticated remote code execution, allowing attackers to gain full control over the affected NetScaler appliance.
  • Potential for lateral movement into the internal network, impacting critical infrastructure and sensitive data.
  • Disruption of network services, data exfiltration, or deployment of ransomware by threat actors.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor NetScaler appliance logs for unusual command execution, unauthorized access attempts, or unexpected process activity.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns targeting NetScaler devices.

Contain

  • Isolate affected NetScaler appliances from the network if immediate patching is not feasible.
  • Review and restrict network access to NetScaler management interfaces to only trusted sources.

Patch

  • Apply vendor-provided security updates for Citrix NetScaler ADC and NetScaler Gateway immediately to address CVE-2026-88771.

Frontier verdict — Low

This vulnerability requires immediate attention due to unauthenticated remote code execution, active exploitation in the wild (CISA KEV), and documented targeting by sophisticated threat actors.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.