CVE-2026-88771 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 64.09%

Affected Products (NVD)

Vendor	Product	Version
citrix	netscaler_application_delivery_controller	13.1 ≤ 𝑥 < 13.1-64.23
citrix	netscaler_application_delivery_controller	13.1 ≤ 𝑥 < 13.1.37.279
citrix	netscaler_application_delivery_controller	14.1 ≤ 𝑥 < 14.1-73.37
citrix	netscaler_application_delivery_controller	14.1-66.68 ≤ 𝑥 ≤ 14.1-73.37
citrix	netscaler_gateway	13.1 ≤ 𝑥 < 13.1-64.23
citrix	netscaler_gateway	14.1 ≤ 𝑥 < 14.1-73.37

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Vulnerability Media Exposure

[GERMAN] Citrix Netscaler: Kritische Sicherheitslücken erlauben Codeeinschleusung
Sicherheitsforscher warnen: Neue Exploits würden aktiv ausgenutzt. Citrix bestätigt die Lücken; Updates werden ausgeliefert.
Published: 2026-09-27T15:51:00+00:00
[ENGLISH] Certainties in life: Death, taxes, and critical Citrix vulns under attack
Sunday NetScaler patch dump fixes trio of critical vulns and five more serious messes
Published: 2026-09-28T08:49:03+02:00
[ENGLISH] Citrix Patches Critical Zero Days Under Active Exploitation
Citrix has confirmed exploitation of two critical zero-day RCE bugs
Published: 2026-09-28T08:30:00+00:00
[ENGLISH] Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Two questions remain: who is abusing the CVEs? And why did Citrix take so long to disclose?
Published: 2026-09-29T19:49:45+02:00
[ENGLISH] Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system. "An improper
Published: 2026-10-02T11:19:50+05:30
[GERMAN] Citrix Netscaler aktualisieren! Zero-Day verursacht Crashes und Codeausführung
Sicherheitsforscher und Administratoren melden massenhafte Spontanreboots betroffener Geräte. Updates sind nun verfügbar und sollten schnell aufgespielt werden.
Published: 2026-10-04T10:58:00+00:00
[ENGLISH] Citrix NetScaler security snafus get even worse amid more 0-day reports
The new vuln, CVE-2026-88779, is a memory overflow bug that leads to denial of service
Published: 2026-10-05T23:18:48+02:00
[ENGLISH] New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to
Published: 2026-10-05T12:10:19+05:30

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771