OTX Threat: CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution vulnerability affecting NetScaler Application Delivery Controller and NetScaler Gateway with a CVSS score of 9.8. The vulnerability enables unauthenticated attackers to execute arbitrary commands without requiring optional features. CISA added it to the Known Exploited Vulnerabilities catalog following confirm CVEs: CVE-2023-3519, CVE-2026-20131, CVE-2026-20253, CVE-2026-75650, CVE-2026-88771