ADC - RCE (CVE-2026-88771)
Description
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
psychologyCrowdSec Analysis
CVE-2026-88771 is a critical improper input validation vulnerability affecting Citrix NetScaler ADC and Gateway. It can allow an unauthenticated attacker to execute arbitrary commands remotely, potentially compromising system confidentiality, integrity, and availability. Affected installations should be updated to a fixed release.
CrowdSec has been tracking this vulnerability and its exploits since 28th of September 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-88771 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers send unauthenticated POST requests to /nf/auth/doAuthentication.do with a crafted login value containing a Pitboss-style log message and shell metacharacters to poison logs and trigger command injection. Other endpoints or ports that log attacker-controlled HTTP headers or request data may also be targeted.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CrowdSec First Seen | 2026-09-22 |
| CVE Published | 2026-09-27 |
| CISA KEV | 2026-09-27 |
| Rule Released | 2026-09-28 |
| CISA Remediation Deadline | 2026-09-30 |