Citrix NetScaler ADC and Gateway unauthenticated remote code execution: arbitrary commands with no login

Who is affected

Citrix says all NetScaler ADC and NetScaler Gateway deployments are affected, including default configurations, and no extra feature needs to be turned on. The version list below comes from the CVE record written by the NetScaler CNA (the body that authored this CVE record) and from Citrix’s bulletin:

FIPS and NDcPP are special builds that meet government encryption and security certification requirements.

• Sources disagree: Citrix (the vendor) and the CVE record list 14.1-73.37 FIPS as fixed, while NVD’s affected range runs “up to and including 14.1-73.37” FIPS. The two have not been reconciled, and this page lists both. Our suggestion: to be safe, organizations running 14.1-73.37 FIPS can confirm with Citrix and still run the compromise checks below.
• Version notation differs: The CVE record writes “13.1.37.279”; Citrix’s bulletin uses both “13.1.37.279” and “13.1-37.279”; BleepingComputer, watchTowr and NCSC-NL write “13.1-37.279”. Our analysis is that this is probably just a formatting difference, but that is unconfirmed.
• BleepingComputer reports that Secure Private Access Hybrid deployments using NetScaler are also affected and must be upgraded.
• watchTowr notes that appliances patched only for the earlier CVE-2026-19490 are still vulnerable unless they run one of the fixed builds above.

How it works

NetScaler usually sits directly on the internet as the front door staff use to log into the company network. Citrix only says the cause is “improper input validation” (CWE-20): the appliance does not properly check incoming data, which lets an unauthenticated attacker run arbitrary commands. The attacker needs network access to an appliance running an affected build. No account and no clicks from anyone are needed. Whether any specific configuration is also required is unconfirmed (see Our analysis). NCSC-NL says this gives attackers full control of the gateway and direct access to the internal network behind it.

Citrix has not disclosed which component is involved or how the input becomes a command. The example below is our generic illustration of a common mistake, passing unchecked input to a shell (the operating system’s command line), known as “command injection”. It shows why improper input validation can lead to command execution; it does not describe NetScaler’s actual root cause.

The flawed approach (conceptual illustration, not Citrix’s source code):

value = field taken from the request
run_shell("error-handling command " + value)   # input gets read as part of the command

The fixed approach:

value = field taken from the request
if not matches_expected_format(value): reject
run_program(["error-handling program", value])  # passed as an argument, never parsed by a shell

Our analysis: Citrix’s CVSS 4.0 vector marks Attack Requirements as “Present” (AT:P), which suggests some deployment condition is needed. Yet the bulletin says all deployments are affected with no extra feature enabled. Citrix has not explained how the two fit together, so whether a specific configuration is needed is unconfirmed.

Exploitation: Citrix says exploitation has been observed on unmitigated deployments. CISA (as quoted by Rapid7 and Help Net Security) says threat actors are exploiting these flaws globally. Rapid7 says it was exploited as a zero-day before vendor disclosure; watchTowr says it was exploited before any fix existed. Help Net Security reports the attacks planted webshells (backdoor web pages that accept remote commands). Researcher Kevin Beaumont says each device got a unique webshell and the attackers ran anti-forensics commands to delete traces. Tenable says it has not been determined whether exploitation is widespread. CISA KEV lists known ransomware use as “Unknown”.

Timeline

Further reading

• Scoring differences: Citrix (the CNA) scores it CVSS 4.0 9.5; NVD separately gives CVSS 3.1 9.8 (marked by NVD as the primary score). The two use different CVSS versions. The 9.8 score and vector at the top of this page are NVD’s CVSS 3.1 rating; Citrix’s 9.5 is listed under key facts.
• CWE differences: Citrix lists CWE-20 (improper input validation); CISA KEV lists CWE-119 (a memory-buffer weakness). The KEV notes also link to the NVD page for the sibling flaw CVE-2026-88772. Our analysis is that the KEV entry may have mixed in details from the sibling CVE, but that is unconfirmed. This page uses Citrix’s classification.
• Discovery: BleepingComputer reports an alleged NCSC-NL pre-notification saying Citrix found the flaws while investigating customer incidents; NCSC-NL declined to confirm it, and the CVE record lists discovery as “unknown”.
• Attribution: None has been made public. One researcher speculates a well-resourced, nation-state-aligned espionage actor; this is unconfirmed.
• Exploited alongside: CVE-2026-88772.