# CVE-2026-88771: ADC - RCE

> Live exploitation tracking for CVE-2026-88771 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-88771

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.5
- **Public exploit available:** Yes
- **Affected products:** Citrix NetScaler ADC, Citrix NetScaler Gateway
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** sslvpn

## Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

## CrowdSec analysis

[CVE-2026-88771](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-88771) is a critical improper input validation vulnerability affecting Citrix NetScaler ADC and Gateway. It can allow an unauthenticated attacker to execute arbitrary commands remotely, potentially compromising system confidentiality, integrity, and availability. Affected installations should be updated to a fixed release.

CrowdSec has been tracking this vulnerability and its exploits since 28th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-88771 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send unauthenticated POST requests to `/nf/auth/doAuthentication.do` with a crafted `login` value containing a Pitboss-style log message and shell metacharacters to poison logs and trigger command injection. Other endpoints or ports that log attacker-controlled HTTP headers or request data may also be targeted.

## Timeline

- 2026-09-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-88771 for the first time.
- 2026-09-27: CVE Published. CVE-2026-88771 is published to NVD.
- 2026-09-27: CISA KEV. CVE-2026-88771 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-09-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-88771 exploitation attempts against the CrowdSec Network.
- 2026-09-30: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
- https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-88771) follows observed exploitation activity for CVE-2026-88771. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.