Citrix NetScaler ADC/Gateway CVE-2026-88771 unauthenticated RCE exploited via log poisoning to drop web shells and FreeBSD implant
Attackers are actively exploiting CVE-2026-88771, a critical (CVSS v4.0 9.5) unauthenticated remote code execution flaw in Citrix NetScaler ADC and Gateway. The bug is an improper input-validation issue that needs no optional features enabled. Citrix disclosed it on September 27, 2026, and CISA added it to the Known Exploited Vulnerabilit…