GPU VulnDB

Database/Control plane, storage & DevOps

Citrix NetScaler ADC/Gateway: unauthenticated attacker executes arbitrary commands on the appliance

CVSS 9.5CVE-2026-88771Control plane, storage & DevOpsKnown exploitedcurated

Impact

An unauthenticated attacker who can reach the appliance gets arbitrary command execution on it. NetScaler typically fronts the whole environment - tenant portals, admin VPN/ICA access, and often the management path into a GPU cluster - so control of it means control of the traffic and credentials passing through, and a foothold inside the trusted network from which the fleet's control plane is reachable. CISA lists this as known exploited, so assume scanning and exploitation are already happening rather than theoretical. Compromise is at the appliance level, not per-tenant: every service published through the affected vServer is affected at once.

Who can reach it

Anyone who can reach the appliance over the network, including from the internet for an externally published Gateway. No authentication and no user interaction required.

What to do

Upgrade to ADC/Gateway 14.1-73.37 or 13.1-64.23 (FIPS: 14.1-73.37 FIPS; FIPS and NDcPP: 13.1.37.279). This is an appliance firmware upgrade with a reboot and a service interruption for everything published through it - plan an HA-pair rolling upgrade or a maintenance window. Because the flaw is known-exploited, treat an unpatched appliance as possibly already compromised: after upgrading, review configuration and sessions and rotate credentials and secrets that transited it. Citrix does not publish a configuration-only mitigation; restricting reachability of the management interface to a management VLAN reduces but does not remove exposure for published Gateway vServers.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-88771https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.