Back to Zero Wire

Citrix NetScaler command executionPatch

CVE-2026-88771

An unauthenticated attacker can execute commands on affected NetScaler ADC and Gateway appliances, including default configurations.

Last reviewed

Updates

  1. Cloudflare published defense-in-depth guidance while distinguishing web authentication from other gateway traffic.

  2. Cloudflare documented a CVE-specific managed WAF rule with a default Block action.

Overview

Details

CVE-2026-88771 allows unauthenticated command execution on affected Citrix NetScaler ADC and Gateway appliances.

The issue can affect default configurations and occurs before the authentication boundary, so exposure review should not be limited to appliances with optional features enabled.

Patching remains necessary. WAF and access controls can reduce exposure of applicable web authentication traffic but do not automatically protect other gateway services, including DTLS listeners.

Risk

Citrix reports exploitation of unmitigated appliances. Attackers can compromise affected gateways before sign-in, including deployments using the default configuration.

Affected deployments

Customer-managed NetScaler ADC or Gateway appliances running an affected release. Default configurations are affected; no optional feature needs to be enabled.

Recommended action

Update affected appliances using Citrix's bulletin. Investigate suspected compromise using the vendor's incident-response guidance.

  1. Inventory all customer-managed NetScaler ADC and Gateway appliances, including Internet-facing and default configurations.

  2. Apply Citrix remediation and investigate any suspected compromise using the vendor's incident-response guidance.

  3. Review whether alternate hostnames, direct-origin paths, or non-HTTP gateway services bypass protective controls.

Cloudflare coverage

Product coverage

Cloudflare has a WAF rule for the documented NetScaler HTTP exploit path.

Review your WAF configuration to determine whether you are protected.

Paid plans

Service status

No impact on Cloudflare infrastructure.

Evidence and sources

Vendor advisory

Affected NetScaler releases, fixes and Citrix's exploitation report.

CVE record

Technical guidance

Cloudflare's response distinguishes WAF coverage from Access and restricted-origin exposure reduction.

Exploit evidence

Citrix reports exploitation on unmitigated deployments.