VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 15:14 UTC
← Dashboard

CVE-2026-88772

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or De…

Read full description
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
CVSS 9.5 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
4.8/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.5: +1.43
  • Fresh EPSS: 76.57%: +0.38

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 39 documents and public datasets.

Hype components

Headline sample (25%)
60/100
Press, 30 days (60%)
55/100
Grounded branding (15%)
0/100
HYPE TOTAL48/100

Sources and documents

Hacker News
Press · 22 Oct 2026, 20:37 · Taking 'execute logging' a bit too seriously – CVE-2026-88771
Bitsight
Press · 21 Oct 2026, 07:00 · CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws - Bitsight
Rapid7 Cybersecurity Blog
Press · 19 Oct 2026, 15:11 · Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Cloudflare Blog
Press · 19 Oct 2026, 13:00 · Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Rapid7
Press · 19 Oct 2026, 07:00 · NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - Rapid7
See all 39 source documents
The Hacker News
Press · 09 Oct 2026, 07:00 · Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments - The Hacker News
SOC Prime
Press · 08 Oct 2026, 07:00 · NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 - SOC Prime
MSSP Alert
Press · 08 Oct 2026, 07:00 · Citrix NetScaler vulnerabilities exploited by attackers - MSSP Alert
Hacker News
Press · 07 Oct 2026, 17:22 · Ten days inside CVE-2026-88771: anatomy of a NetScaler exploitation wave
https://tech-insider.org/
Press · 07 Oct 2026, 07:00 · Citrix NetScaler Hit by 3rd Zero-Day, CVE-2026-88779 [2026] - https://tech-insider.org/
watchTowr
Press · 07 Oct 2026, 07:00 · Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771 - watchTowr
Cybersecurity Dive
Press · 05 Oct 2026, 07:00 · Citrix issues patch for third exploited flaw in NetScaler - Cybersecurity Dive
The Hacker News
Press · 05 Oct 2026, 07:00 · New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline - The Hacker News
SOC Prime
Press · 05 Oct 2026, 07:00 · CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments - SOC Prime
Unit 42
Press · 30 Sep 2026, 20:00 · Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Una Al Día
Press · 30 Sep 2026, 15:08 · Una campaña explota dos zero-days críticos en Citrix NetScaler para instalar web shells y moverse por la red
Unit 42
Press · 30 Sep 2026, 07:00 · Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) - Unit 42
The Hacker News
Press · 30 Sep 2026, 07:00 · Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution - The Hacker News
Help Net Security
Press · 30 Sep 2026, 07:00 · Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) - Help Net Security
Threat Intelligence
Press · 29 Sep 2026, 14:00 · Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
watchTowr Labs
Press · 29 Sep 2026, 13:55 · Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
watchTowr Labs
Press · 29 Sep 2026, 13:55 · Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
Help Net Security
Press · 29 Sep 2026, 07:00 · NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) - Help Net Security
Google Cloud
Press · 29 Sep 2026, 07:00 · Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances - Google Cloud
watchTowr Labs
Press · 29 Sep 2026, 07:00 · Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs
Hacker News
Press · 28 Sep 2026, 22:51 · Taking 'execute logging' a bit too literally CVE-2026-88771
Hacker News
Press · 28 Sep 2026, 16:11 · Active, in-the-wild exploitation of CVE-2026-88771 with IoCs
Hacker News
Press · 28 Sep 2026, 15:11 · Citrix NetScaler PreAuth Command Injection CVE-2026-88771
watchTowr Labs
Press · 28 Sep 2026, 10:55 · Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
Help Net Security
Press · 28 Sep 2026, 07:00 · Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security
Rapid7
Press · 28 Sep 2026, 07:00 · Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 - Rapid7
The Hacker News
Press · 28 Sep 2026, 07:00 · CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally - The Hacker News
Rescana
Press · 28 Sep 2026, 07:00 · Active Exploitation of Citrix NetScaler ADC and Gateway Zero-Day Vulnerabilities (CVE-2026-88771, CVE-2026-88772) – Urgent Patch Required - Rescana
SecurityWeek
Press · 28 Sep 2026, 07:00 · Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug - SecurityWeek
watchTowr Labs
Press · 28 Sep 2026, 07:00 · Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs
Sophos
Press · 28 Sep 2026, 07:00 · Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation - Sophos
watchTowr
Press · 27 Sep 2026, 21:28 · CVE-2026-88771: Citrix NetScaler ADC & Citrix NetScaler Gateway Vulnerability - watchTowr
watchTowr
Press · 27 Sep 2026, 07:00 · Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772 - watchTowr
The Hacker News
Press · 27 Sep 2026, 07:00 · Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.7Reality 8.805 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 4.8Reality 8.8Nov 2Nov 5

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
murrez/CVE-2026-88772122Python20 Oct 2026, 14:14
FollowerSeize/CVE-2026-88772-POC00—28 Sep 2026, 09:58
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.5; EPSS 76.6%
Attention, last 30 days
6 distinct story titles; 6 press documents; 4 publisher domains.
Technical potential
network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:30.512549+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
27 Sep 2026, 00:00
First press mention
27 Sep 2026, 07:00
Published
27 Sep 2026, 16:09
Latest press mention
22 Oct 2026, 20:37
Score calculated
05 Nov 2026, 14:00
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar