CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and NetScaler Gateway. The vulnerability enables unauthenticated attackers to execute arbitrary commands by poisoning access and authentication logs with malicious payloads, which are then executed by a vulnerable Perl diagnostic script with elevated privileges. Exploitation has been confirmed globally, involving deployment of web shells, enabling PHP, and delivering FreeBSD implants. The attack chain includes Base64-encoded payloads staged in HTTP User-Agent headers and forged PPE failure messages. This vulnerability is linked to infrastructure overlapping with exploitation of CVE-2026-75650 targeting Adobe Commerce systems. The CVSS score is 9.8, indicating critical severity. No patch or official remediation information is provided in the source data.

The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected NetScaler devices with elevated privileges. This leads to full system compromise, including deployment of persistent web shells, enabling of PHP execution, and installation of FreeBSD implants. The confirmed worldwide exploitation and inclusion in CISA's Known Exploited Vulnerabilities catalog indicate active threat and significant risk to affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Citrix advisories closely. Mitigation may require disabling vulnerable diagnostic scripts or applying vendor-recommended configurations once available.