Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV

CVE-2026-88771

  1. KEV
  2. 1 day →First PoC
  3. 3 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2026-09-27 · due 2026-09-30. An observation, not a forecast.
EPSS · 30-day forecast
1%Chance of exploitation in the next 30 days, 65th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD
not stated by sourcesNo NVD record yet.
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

11 known · links only

GitHub PoCs · by trust, then stars11

  1. watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 ↗Trust ok 100

    ★ 23 · created 2026-09-27

  2. ThomasPoppelgaard/netscaler-ctx697096-checker ↗Trust ok 100

    Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174 (CVE-2026-88779) and CTX697191 (CVE-2026-107406, SAML RCE): build, CVE preconditions, SAML IdP/SP, Enhanced ISN, upgrade risks + IoC sweep by default with every public IoC (webshells, implants, 132 attacker IPs).

    ★ 18 · created 2026-09-28

  3. craigsblackie/cve-2026-88771-netscaler ↗Trust ok 100

    ★ 1 · created 2026-09-28

  4. grupooruss/netscaler-defensive-checker ↗Trust ok 100

    Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778

    ★ 1 · created 2026-10-08

  5. technion/netscaler_scanner ↗Trust ok 100

    Tooling related to CVE-2026-88771 and CVE-2026-88772

    ★ 1 · created 2026-09-28

  6. bkchaudhari/NetScaler-CTX697096-Assessment-Script ↗Trust ok 100

    a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.

    ★ 0 · created 2026-10-01

  7. emilstahl/pitscaler ↗Trust ok 100

    PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com

    ★ 0 · created 2026-10-01

  8. orjanj/netscaler_threat_hunt_helper ↗Trust ok 100

    NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

    ★ 0 · created 2026-10-01

  9. SwiftSecur/CVE-2026-88771-HuntScript ↗Trust ok 100

    A detection/hunting script for compromise related to CVE-2026-88771

    ★ 0 · created 2026-09-29

  10. techupdate24/citrix-netscaler-cve-2026-88771-rce ↗Trust ok 100

    A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

    ★ 0 · created 2026-09-28

  11. watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs ↗Trust ok 100

    ★ 0 · created 2026-10-02

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

1 dispatch
  1. NCSC-2026-0394 [1.01] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler GatewayKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.