CVE-2026-88771Vulnerability
Citrix NetScaler Improper Input Validation Vulnerability
Reported by 25 independent sources · first reported by CISA advisories · last reported
Last reported 5 days ago
Fix due 30 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 92% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
59 reports · the newest 20, newest first · the exact sentence from each-
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779“Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779”
-
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability“CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability”
-
Top RCE Vulnerabilities“CVE-2026-88771, CVE-2026-88772”
-
September 2026 CVE Landscape“September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.”
-
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability“Recently, the company confirmed active exploitation of two other flaws, respectively tracked as CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5), on unpatched systems and urged customers to install the relevant updates as soon as possible.”
-
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability“A week before, two other NetScaler zero-days were patched: CVE-2026-88771 (leading to RCE), and CVE-2026-88772 (leading to RCE or DoS).”
-
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation“NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation”
-
Q3 2026 Vulnerability Trend Report“CVE-2026-88771 A lack of input validation in Citrix NetScaler ADC/Gateway allowed for remote code execution without authentication.”
-
Q3 2026 Attack Techniques Trend Report“Regarding breaches of perimeter devices, exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway, as well as CVE-2026-20079 in Cisco Secure Firewall Management Center (FMC), CVE-2026-20316 were confirmed.”
-
CVE-2026-88779: Citrix NetScaler Zero-Day“Appliances already updated for the earlier CVE-2026-88771 through CVE-2026-88778 issues may still require this newer update.”
-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“Next: Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)”
-
Citrix discloses third actively exploited NetScaler zero-day in less than a week“…nical links with the pair of zero-days Citrix disclosed less than a week prior, but it can accelerate one of those vulnerabilities — CVE-2026-88771 — by intentionally crashing machines to speed up exploitation, Knott said.”
-
Citrix NetScaler security snafus get even worse amid more 0-day reports“…s finally disclosed by Citrix on September 27 - weeks after miscreants began abusing two of these security holes (CVE-2026-88772 and CVE-2026-88771) - watchTowr researchers told us they suspect it has been used to purposefully crash machines, making exploitation of CVE-2026-88771…”
-
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)“…e been hit by crashes and reboots after they’ve upgraded to patch eight vulnerabilities, including two actively exploited zero-days: CVE-2026-88771 and CVE-2026-88772.”
-
5th October – Threat Intelligence Report“Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.”
-
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline“The development also follows reports of active exploitation of CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunneling tools on compromised systems.”
-
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier“The attacks were spotted just days after NetScaler administrators were warned about two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which forced some customers to pull the plug.”
-
Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)“CVE-2026-88771”
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited“Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)”
-
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes“…ess Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.”
Indicators reported together
named in the same reports- doauthentication[.]doin 2 reports
Copy this indicator · defanged
Also named with it: CVE-2026-88772, CVE-2026-88779, CVE-2026-76504, CVE-2026-85102, CVE-2026-86950, CVE-2026-104286, CVE-2026-93616, CVE-2026-94127, CVE-2026-107406, CVE-2026-60004, CVE-2026-20316, CVE-2026-76460, CVE-2026-76461, CVE-2026-20079, CVE-2026-87902, CVE-2026-5430, CVE-2026-85706, CVE-2026-93952, CVE-2026-84869
Thanks — we review every report.