VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 15:03 UTC
← Dashboard

CVE-2026-88771

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a…

Read full description
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
CVSS 9.5 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
4.5/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.5: +1.43
  • Fresh EPSS: 81.89%: +0.41

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 37 documents and public datasets.

Hype components

Headline sample (25%)
70/100
Press, 30 days (60%)
45/100
Grounded branding (15%)
0/100
HYPE TOTAL44/100

Sources and documents

"CVE-2026-88771" - Google News
Press · 21 Oct 2026, 07:00 · CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws - Bitsight
Rapid7 Cybersecurity Blog
Press · 19 Oct 2026, 15:11 · Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Cloudflare Blog
Press · 19 Oct 2026, 13:00 · Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Cloudflare Blog
Press · 19 Oct 2026, 13:00 · Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Rapid7
Press · 19 Oct 2026, 07:00 · NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - Rapid7
See all 37 source documents
SOC Prime
Press · 12 Oct 2026, 07:00 · CVE-2026-88771: Citrix NetScaler Web Shell Attacks - SOC Prime
SOC Prime
Press · 08 Oct 2026, 07:00 · NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 - SOC Prime
https://tech-insider.org/
Press · 07 Oct 2026, 07:00 · Citrix NetScaler Hit by 3rd Zero-Day, CVE-2026-88779 [2026] - https://tech-insider.org/
watchTowr
Press · 07 Oct 2026, 07:00 · Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771 - watchTowr
SOCRadar
Press · 07 Oct 2026, 07:00 · NetScaler C2: CVE-2026-88771 Exploitation Operation - SOCRadar
The Hacker News
Press · 05 Oct 2026, 07:00 · New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline - The Hacker News
SecurityWeek
Press · 05 Oct 2026, 07:00 · Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier - SecurityWeek
SOC Prime
Press · 05 Oct 2026, 07:00 · CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments - SOC Prime
shattered.io
Press · 01 Oct 2026, 14:13 · Citrix NetScaler CVE-2026-88772 Zero-Day: CVSS 9.5, CISA KEV - shattered.io
The Hacker News
Press · 01 Oct 2026, 07:00 · Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - The Hacker News
Unit 42
Press · 30 Sep 2026, 20:00 · Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Unit 42
Press · 30 Sep 2026, 20:00 · Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Una Al Día
Press · 30 Sep 2026, 15:08 · Una campaña explota dos zero-days críticos en Citrix NetScaler para instalar web shells y moverse por la red
Help Net Security
Press · 30 Sep 2026, 07:00 · Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) - Help Net Security
Unit 42
Press · 30 Sep 2026, 07:00 · Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) - Unit 42
Threat Intelligence
Press · 29 Sep 2026, 14:00 · Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
watchTowr Labs
Press · 29 Sep 2026, 13:55 · Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
Google Cloud
Press · 29 Sep 2026, 07:00 · Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances - Google Cloud
Help Net Security
Press · 29 Sep 2026, 07:00 · NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) - Help Net Security
watchTowr Labs
Press · 29 Sep 2026, 07:00 · Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs
watchTowr Labs
Press · 28 Sep 2026, 10:55 · Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
watchTowr Labs
Press · 28 Sep 2026, 10:55 · Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
SecurityWeek
Press · 28 Sep 2026, 07:00 · Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug - SecurityWeek
Help Net Security
Press · 28 Sep 2026, 07:00 · Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security
Rapid7
Press · 28 Sep 2026, 07:00 · Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 - Rapid7
The Hacker News
Press · 28 Sep 2026, 07:00 · CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally - The Hacker News
Rescana
Press · 28 Sep 2026, 07:00 · Active Exploitation of Citrix NetScaler ADC and Gateway Zero-Day Vulnerabilities (CVE-2026-88771, CVE-2026-88772) – Urgent Patch Required - Rescana
watchTowr Labs
Press · 28 Sep 2026, 07:00 · Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs
Sophos
Press · 28 Sep 2026, 07:00 · Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation - Sophos
watchTowr
Press · 27 Sep 2026, 21:28 · CVE-2026-88771: Citrix NetScaler ADC & Citrix NetScaler Gateway Vulnerability - watchTowr
watchTowr
Press · 27 Sep 2026, 07:00 · Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772 - watchTowr
The Hacker News
Press · 27 Sep 2026, 07:00 · Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.0Reality 8.802 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.3Reality 8.805 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 4.5Reality 8.8Nov 2Nov 2Nov 5

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.5; EPSS 81.9%
Attention, last 30 days
5 distinct story titles; 6 press documents; 3 publisher domains.
Technical potential
network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:30.512549+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
27 Sep 2026, 00:00
First press mention
27 Sep 2026, 07:00
Published
27 Sep 2026, 16:02
Latest press mention
21 Oct 2026, 07:00
Score calculated
05 Nov 2026, 14:00
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar