CVE-2026-88771

An unauthenticated attacker can execute arbitrary commands on Citrix NetScaler ADC and Gateway due to improper input validation.

This improper input validation flaw allows remote code execution without authentication, enabling attackers to fully compromise the ADC and gateway devices. DIB organizations must care because NetScaler is widely deployed in critical infrastructure, and this vulnerability is actively exploited in the wild, leading to potential data breaches and ransomware entry points. Organizations should immediately patch their NetScaler deployments and monitor for exploitation attempts.

Shame score — A critical RCE vulnerability in a widely deployed ADC product is actively exploited in the wild, demonstrating severe negligence in patching and security posture.