Citrix patches NetScaler CVE-2026-88771: root RCE via log data

Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities on 27 September 2026, two of them already exploited. CVE-2026-88771 and CVE-2026-88772 carry CVSS v4 9.5, and CISA added them to its KEV catalog with a 30 September deadline. Fixes shipped in 14.1-73.37, 13.1-64.23 and FIPS builds.

• CVE-2026-88771 and CVE-2026-88772 scored CVSS v4 9.5 and were added to CISA KEV
• Earliest exploitation attempt logged on 24 September, before any patch
• Root cause is ns_monuploadd_err.pl, which builds a shell command from log data
• Fixes: 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37 and 13.1-37.279