CVE-2026-88771: Unauthenticated command injection in NetScaler ADC and Gateway

What it is

A pre-authentication command injection in NetScaler ADC and Gateway. An unauthenticated attacker can run commands as root on the appliance. Citrix rates it 9.5 (CVSS 4.0) and confirms exploitation of unmitigated appliances.

watchTowr traced the root cause. A NetScaler script, ns_monuploadd_err.pl, reads a crashed-process filename out of the logs and pastes it into a second shell command without checking it. An attacker who gets crafted text into the logs, for example through the username field of a failed login, gets that text run as a command the next time the script runs. That can take up to 24 hours.

It was a zero-day. Rapid7 saw the first attempt on September 20, a week before Citrix published a fix. After watchTowr published its analysis on September 28, exploitation turned into mass scanning, and eSentire saw attackers reusing watchTowr’s payload within hours. Public reporting also describes web shells, stolen configuration files, backdoor admin accounts and reverse shells.

The same bulletin fixes CVE-2026-88772, a separate DTLS memory overflow that was also exploited as a zero-day. A third bug, CVE-2026-88779, was exploited and fixed on October 4. Patch to the builds for that CVE.

Am I affected?

You’re affected if you run a customer-managed NetScaler ADC or Gateway below these builds:

• 14.1 before 14.1-73.37
• 13.1 before 13.1-64.23
• 14.1 FIPS before 14.1-73.37 FIPS
• 13.1 FIPS and NDcPP before 13.1.37.279

Rapid7 and watchTowr say the default configuration is vulnerable. No optional feature has to be enabled. Any NetScaler that logs attacker-supplied HTTP data may be reachable, so don’t assume only your login page matters.

BleepingComputer reports that Secure Private Access Hybrid deployments using NetScaler instances are also in scope. Cloud Software Group is upgrading Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself.

Citrix’s bulletin CTX697096 has a section on determining whether an appliance meets the preconditions, according to Unit 42. Use it to confirm exposure.

What to do

1. Upgrade now, outside your normal change window. Move to at least the builds above. Rapid7 lists newer builds that also fix CVE-2026-88779: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1.37.282. Prefer those.
2. Don’t wait for a workaround. Rapid7 and Unit 42 list none, and BleepingComputer’s coverage of the bulletin describes none. If you can’t patch yet, cut internet exposure where you can. Some IT suppliers advised shutting appliances down.
3. Assume compromise if you were exposed and unpatched. Patching does not remove an attacker who is already on the box (Sophos, Unit 42). Citrix’s own detection script may miss real compromises.
4. Preserve evidence before you reboot or rebuild. Unit 42 asks for a VPX snapshot, logs from your syslog server and NetScaler Console, a technical support bundle and a packet engine core dump. Citrix article CTX694799 covers what to do when you suspect compromise.
5. Rebuild any confirmed or likely compromised appliance and rotate secrets. Rapid7 notes the stolen archive holds ns.conf (admin password hashes and LDAP, RADIUS and TACACS bind passwords), TLS certificates and private keys, SSH host keys and license files. Rotate all of them, and revoke and reissue certificates.

Detection

Look back to at least September 20, 2026. Unit 42 and Lupovis saw earlier probing, but the first injection attempt reported by Rapid7 is that date.

Logs

• Search NetScaler logs for the string pitboss. The injected text is framed as pitboss PPE unexpectedly died NSPPE followed by a command (Unit 42, eSentire). This also shows attempts against patched devices, so it doesn’t prove success.
• Rapid7 saw the command in a rejected-login log entry. Shell metacharacters or ${IFS} in a username field are a red flag.
• Look for POSTs to /nf/auth/doAuthentication.do whose body contains pitboss PPE unexpectedly died NSPPE (Lupovis).
• Look for a base64-encoded dropper in the User-Agent header in /var/log/httpaccess-vpn.log (Unit 42).
• Look for requests to /vpn/c, which serves the stolen config archive without authentication (Rapid7).
• Look for requests to .ctxs.receiver, to CSS-looking aliases such as /logon/LogonPoint/custom/receiver.min.css and /logon/LogonPoint/css/LogonUISimple.html.style.min.css, and to the .deb files under /vpn/scripts/linux/ (Unit 42, eSentire).
• Look for requests carrying the header HTTP_NSC_CLIENTTYPE (eSentire).

On the appliance

• Unexpected files in /var/netscaler/logon/LogonPoint/ and /var/netscaler/gui/vpn/scripts/linux/.
• Edits to /etc/httpd.conf, especially php_flag engine on and new Alias entries.
• The SUID and SGID bits set on /bin/sh, which Unit 42 and eSentire both saw.
• New superuser accounts in /flash/nsconfig/ns.conf, such as gw_health (watchTowr), and unfamiliar authorized_keys entries.
• Outbound connections or DNS lookups to the indicators listed above, and a service listening on tcp/37512 (watchTowr’s trojanized Dropbear SSH).

Other published indicators

Arctic Wolf and Mandiant published indicators for the follow-on and earlier attacks, and CERT-EU published hunting advice. We could not open those pages, so they aren’t included here. Check them directly.