{"schema":"vulnpedia.research/1","cve":"CVE-2026-88771","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","tags":["Vendor Advisory","KEV report"],"source":"mitre","sourceId":"NetScaler","modified":"2026-09-27T16:02:07.001Z","origins":[{"source":"mitre","sourceId":"NetScaler","modified":"2026-09-27T16:02:07.001Z","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"},{"source":"nvd","sourceId":"CVE-2026-88771","modified":"2026-09-29T04:18:01.603","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-29T03:55:15.090Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-29T03:55:15.090Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771"},{"source":"nvd","sourceId":"CVE-2026-88771","modified":"2026-09-29T04:18:01.603","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771"}]},{"source":"euvd","sourceId":"EUVD-2026-87958","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-87958","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://support.citrix.com/external/article/CTX697096","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://support.citrix.com/external/article/CTX697096"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/"}]},{"url":"https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation"}]},{"url":"https://x.com/DefusedCyber/status/2104602270444736911","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://x.com/DefusedCyber/status/2104602270444736911"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771"}]},{"url":"https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/"}]},{"url":"https://asec.ahnlab.com/en/95733/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://asec.ahnlab.com/en/95733/"}]},{"url":"https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/"}]},{"url":"https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg"}]},{"url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-21&host_type=src&vulnerability=cve-2026-88771","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-21&host_type=src&vulnerability=cve-2026-88771"}]},{"url":"https://vulncheck.com/xdb/0a8c0d2742d5","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"0a8c0d2742d5","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0a8c0d2742d5","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/xdb/0a8c0d2742d5"}]},{"url":"https://github.com/craigsblackie/cve-2026-88771-netscaler","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"0a8c0d2742d5","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0a8c0d2742d5","modified":"2026-09-27T00:00:00Z","url":"https://github.com/craigsblackie/cve-2026-88771-netscaler"}]},{"url":"https://vulncheck.com/xdb/3d8733b67bc2","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"3d8733b67bc2","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3d8733b67bc2","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/xdb/3d8733b67bc2"}]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"3d8733b67bc2","modified":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3d8733b67bc2","modified":"2026-09-27T00:00:00Z","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-20T16:49:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-20T16:49:47Z","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771"}],"tags":[]},{"url":"https://github.com/technion/netscaler_scanner","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"Tooling related to CVE-2026-88771 and CVE-2026-88772","modified":"2026-10-09T00:09:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/technion/netscaler_scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-09T00:09:24Z","url":"https://github.com/technion/netscaler_scanner"}],"tags":[]},{"url":"https://github.com/craigsblackie/cve-2026-88771-netscaler","source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-15T07:27:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/craigsblackie/cve-2026-88771-netscaler"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-15T07:27:16Z","url":"https://github.com/craigsblackie/cve-2026-88771-netscaler"}],"tags":[]},{"url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174, CTX697191 (SAML RCE) and php2shell (management GUI): build, CVE preconditions, SAML, mgmt exposure, MFA, upgrade risks + IoC sweep with every public IoC (webshells, implants, 133 attacker IPs).","modified":"2026-10-24T01:23:59Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-24T01:23:59Z","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker"}],"tags":[]},{"url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-88771-rce","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.","modified":"2026-09-28T11:37:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-88771-rce"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-09-28T11:37:06Z","url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-88771-rce"}],"tags":[]},{"url":"https://github.com/SwiftSecur/CVE-2026-88771-HuntScript","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"A detection/hunting script for compromise related to CVE-2026-88771","modified":"2026-09-29T14:29:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/SwiftSecur/CVE-2026-88771-HuntScript"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-09-29T14:29:40Z","url":"https://github.com/SwiftSecur/CVE-2026-88771-HuntScript"}],"tags":[]},{"url":"https://github.com/bkchaudhari/NetScaler-CTX697096-Assessment-Script","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.","modified":"2026-10-01T02:17:43Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/bkchaudhari/NetScaler-CTX697096-Assessment-Script"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-01T02:17:43Z","url":"https://github.com/bkchaudhari/NetScaler-CTX697096-Assessment-Script"}],"tags":[]},{"url":"https://github.com/emilstahl/pitscaler","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com","modified":"2026-10-20T12:07:52Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/emilstahl/pitscaler"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-20T12:07:52Z","url":"https://github.com/emilstahl/pitscaler"}],"tags":[]},{"url":"https://github.com/orjanj/netscaler_threat_hunt_helper","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779","modified":"2026-10-21T19:37:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/orjanj/netscaler_threat_hunt_helper"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-21T19:37:31Z","url":"https://github.com/orjanj/netscaler_threat_hunt_helper"}],"tags":[]},{"url":"https://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs","source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-07T16:36:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-07T16:36:41Z","url":"https://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs"}],"tags":[]},{"url":"https://github.com/grupooruss/netscaler-defensive-checker","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778","modified":"2026-10-08T01:07:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/grupooruss/netscaler-defensive-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-08T01:07:18Z","url":"https://github.com/grupooruss/netscaler-defensive-checker"}],"tags":[]},{"url":"https://github.com/CompleTetech-Security/netscaler-cve-2026-88771-check","source":"poc-in-github","sourceId":"CVE-2026-88771","description":"Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.","modified":"2026-10-26T05:11:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-88771","url":"https://github.com/CompleTetech-Security/netscaler-cve-2026-88771-check"},{"source":"poc-in-github","sourceId":"CVE-2026-88771","modified":"2026-10-26T05:11:51Z","url":"https://github.com/CompleTetech-Security/netscaler-cve-2026-88771-check"}],"tags":[]}],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb","source":"metasploit","sourceId":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","description":"Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","modified":"2026-10-22 15:37:05 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"},{"source":"metasploit","sourceId":"exploit/freebsd/http/citrix_netscaler_cve_2026_88771","modified":"2026-10-22 15:37:05 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"}],"tags":[]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"0a8c0d2742d5","url":"https://vulncheck.com/xdb/0a8c0d2742d5","cve":"CVE-2026-88771","dateAdded":"2026-09-30T16:18:55Z","modified":"2026-09-27T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/craigsblackie/cve-2026-88771-netscaler","observations":[{"dateAdded":"2026-09-30T16:18:55Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"0a8c0d2742d5","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/xdb/0a8c0d2742d5"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"3d8733b67bc2","url":"https://vulncheck.com/xdb/3d8733b67bc2","cve":"CVE-2026-88771","dateAdded":"2026-09-30T17:17:10Z","modified":"2026-09-27T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","observations":[{"dateAdded":"2026-09-30T17:17:10Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"3d8733b67bc2","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/xdb/3d8733b67bc2"}]}],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-87958","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958","dateAdded":"2026-09-27","origins":[{"source":"euvd","sourceId":"EUVD-2026-87958","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-09-27T00:00:00Z","modified":"2026-09-27T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Citrix","product":"NetScaler ADC and NetScaler Gateway","dueDate":"2026-09-30T00:00:00Z","cisaDateAdded":"2026-09-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","modified":"2026-09-27T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://support.citrix.com/external/article/CTX697096","dateAdded":"2026-09-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://support.citrix.com/external/article/CTX697096"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/","dateAdded":"2026-09-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://x.com/DefusedCyber/status/2104602270444736911"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-09-29T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2026-88771"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-09-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2026-88771"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-10-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2026-88771"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-10-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2026-88771"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-10-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2026-88771"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771","dateAdded":"2026-10-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://asec.ahnlab.com/en/95733/","dateAdded":"2026-10-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://asec.ahnlab.com/en/95733/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg","dateAdded":"2026-10-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg"},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-21&host_type=src&vulnerability=cve-2026-88771","dateAdded":"2026-10-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-88771","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-21&host_type=src&vulnerability=cve-2026-88771"}]}]}