Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators

Reported 01 Oct 2026 by otx · Severity: medium

CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. LevelBlue's Threat Hunt Operations & Research (THOR) team identified active exploitation across multiple customer environments featuring malicious