Source: https://agentdast.com/newsletter/citrix-netscaler-command-execution-cve-2026-88771

# Citrix NetScaler command execution: investigate and update appliances

[By Tornike (@realtornikeo)](https://x.com/realtornikeo)

 Published Nov 4, 2026  Last updated Nov 5, 2026 

Original sources: [Citrix: affected builds and security bulletin](https://support.citrix.com/external/article/CTX697096); [CISA: exploitation and evidence guidance](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc442); [Citrix: steps for suspected compromise](https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html)

## Does this apply to me?

**NetScaler ADC and Gateway 14.1** Before 14.1-73.37 

Customer-managed appliance; no additional feature is required.

Action: 14.1-73.37 or later

**NetScaler ADC and Gateway 13.1** Before 13.1-64.23 

Customer-managed appliance; default configurations are affected.

Action: 13.1-64.23 or later in the 13.1 branch

**NetScaler ADC FIPS and NDcPP** 14.1-FIPS before 14.1-73.37; 13.1-FIPS and 13.1-NDcPP before 13.1-37.279 

Customer-managed appliance; no additional feature is required.

Action: 14.1-73.37 FIPS or 13.1-37.279 for the respective branch

## How severe is it?

**Critical: CVSS 9.5**

Successful exploitation can run arbitrary commands without authentication. Citrix and CISA report exploitation, which does not establish that any particular appliance was compromised.

Citrix rates the issue Critical, CVSS v4.0 9.5. My assessment is that exposed appliances need urgent investigation and remediation.

First reported Sep 27, 2026

`CVE-2026-88771`

## What happened

Citrix disclosed CVE-2026-88771 on September 27, 2026. Improper input validation can let an unauthenticated remote attacker execute commands. Citrix reports exploitation on unmitigated deployments, and CISA confirms active exploitation globally.

Citrix's bulletin applies to customer-managed appliances, including NetScaler instances in Secure Private Access Hybrid deployments. All affected deployments meet the configuration prerequisite, including default installations. Citrix manages updates for its own cloud services.

## What to do now

1.  If possible, check for signs of compromise before patching. If compromise is suspected, preserve forensic evidence first; updates can reduce forensic visibility. Citrix recommends retaining appliance and remote logs and, for virtual instances, a snapshot.
2.  Promptly install the fixed build for each affected appliance. Verify every deployed instance, including those used by Secure Private Access Hybrid.
3.  For suspected compromise, follow Citrix's recovery guidance: isolate the appliance, revoke exposed credentials and certificates, investigate connected systems, and rebuild or replace the instance before restoring a known-good configuration.

## What this means for your website

NetScaler appliances can sit in front of websites and authentication systems. A compromised appliance can put connected services and secrets at risk. An update closes the flaw but cannot establish that earlier attacker access has been removed. Alongside the vendor recovery steps, use AgentDAST to investigate the public website and bring its request evidence into your review.

## Sources and updates

-   [Citrix: affected builds and security bulletin ↗](https://support.citrix.com/external/article/CTX697096)
-   [CISA: exploitation and evidence guidance ↗](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc442)
-   [Citrix: steps for suspected compromise ↗](https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html)

Follow the linked vendor notices for subsequent corrections and updates. The publication and revision dates above track this brief.

### Discover vulnerabilities before bad actors do.

AgentDAST tests your live website and returns request evidence your coding agent can investigate. Start with one free health preview and choose a monitoring plan to unlock detailed reports.

[Set up your agent →](https://agentdast.com/agents)

## Keep reading

-   [eMudhra CA keys compromised: update trust stores and check certificate chains](https://agentdast.com/newsletter/emudhra-certificate-authority-key-compromise)
-   [Node2Shell: update Brotli decoders across your website stack](https://agentdast.com/newsletter/node2shell-brotli-cve-2026-111497)