On this page

Citrix NetScaler command execution: investigate and update appliances

By Tornike@realtornikeoPublished Nov 4, 2026Last updated Nov 5, 2026

Original sources: Citrix: affected builds and security bulletin; CISA: exploitation and evidence guidance; Citrix: steps for suspected compromise

Does this apply to me?

NetScaler ADC and Gateway 14.1Before 14.1-73.37: Customer-managed appliance; no additional feature is required.Action: 14.1-73.37 or later
NetScaler ADC and Gateway 13.1Before 13.1-64.23: Customer-managed appliance; default configurations are affected.Action: 13.1-64.23 or later in the 13.1 branch
NetScaler ADC FIPS and NDcPP14.1-FIPS before 14.1-73.37; 13.1-FIPS and 13.1-NDcPP before 13.1-37.279: Customer-managed appliance; no additional feature is required.Action: 14.1-73.37 FIPS or 13.1-37.279 for the respective branch

How severe is it?

Critical: CVSS 9.5

Successful exploitation can run arbitrary commands without authentication. Citrix and CISA report exploitation, which does not establish that any particular appliance was compromised.

Citrix rates the issue Critical, CVSS v4.0 9.5. My assessment is that exposed appliances need urgent investigation and remediation.

First reported Sep 27, 2026

CVE-2026-88771

What happened

Citrix disclosed CVE-2026-88771 on September 27, 2026. Improper input validation can let an unauthenticated remote attacker execute commands. Citrix reports exploitation on unmitigated deployments, and CISA confirms active exploitation globally.

Citrix's bulletin applies to customer-managed appliances, including NetScaler instances in Secure Private Access Hybrid deployments. All affected deployments meet the configuration prerequisite, including default installations. Citrix manages updates for its own cloud services.

What to do now

If possible, check for signs of compromise before patching. If compromise is suspected, preserve forensic evidence first; updates can reduce forensic visibility. Citrix recommends retaining appliance and remote logs and, for virtual instances, a snapshot.
Promptly install the fixed build for each affected appliance. Verify every deployed instance, including those used by Secure Private Access Hybrid.
For suspected compromise, follow Citrix's recovery guidance: isolate the appliance, revoke exposed credentials and certificates, investigate connected systems, and rebuild or replace the instance before restoring a known-good configuration.

What this means for your website

NetScaler appliances can sit in front of websites and authentication systems. A compromised appliance can put connected services and secrets at risk. An update closes the flaw but cannot establish that earlier attacker access has been removed. Alongside the vendor recovery steps, use AgentDAST to investigate the public website and bring its request evidence into your review.

Sources and updates

Follow the linked vendor notices for subsequent corrections and updates. The publication and revision dates above track this brief.

Discover vulnerabilities before bad actors do.

AgentDAST tests your live website and returns request evidence your coding agent can investigate. Start with one free health preview and choose a monitoring plan to unlock detailed reports.

Set up your agent →