NetScaler CVE-2026-88771: the script that turns log data into a root shell

Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway on 27 September 2026. Two of them were already being exploited. CVE-2026-88771 and CVE-2026-88772 both carry CVSS v4 9.5, and CISA added them to the KEV catalog on the day of disclosure with a federal deadline of 30 September 2026. GreyNoise recorded its earliest exploitation attempt on 24 September 2026, before any patch was public.
The two issues have different preconditions. CVE-2026-88771 affects every NetScaler ADC and NetScaler Gateway deployment. CVE-2026-88772 requires DTLS to be enabled, and DTLS is on by default for VPN virtual servers, so a NetScaler Gateway is in scope unless someone explicitly turned it off.

Root cause of CVE-2026-88771

watchTowr Labs traced the problem to a Perl script named ns_monuploadd_err.pl, which processes crash and error information. The script builds a shell command from input an attacker can influence. Because NetScaler writes some of that input to its logs and then feeds the log data back into the script, an unauthenticated attacker can inject shell commands through data that flows into the logging path. The result is remote code execution as root. Reaching the trigger requires sending a pre-authentication request to the /nf/auth/doAuthentication.do endpoint.
That chain is what makes the bug operationally awkward. The vulnerable code is not in the authentication decision itself; it sits downstream in error handling. A conventional test that only checks whether authentication succeeds will not reveal it.

What happened after exploitation

Public reporting describes an exploitation chain that used CVE-2026-88772 to obtain root through the DTLS memory overflow, then deployed two tools: WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python tunnelling utility used for internal reconnaissance and credential theft. Citrix published generic indicators of compromise through NetScaler Console, and separate guidance for customers who suspect a compromise.
The honest limit here is scope. Citrix did not say how many deployments were affected, by whom, or since when. Do not convert "actively exploited" into an exploitation count.

Fixed versions

The fixes are in NetScaler ADC and NetScaler Gateway 14.1-73.37 and later 14.1 releases, 13.1-64.23 and later 13.1 releases, 14.1-FIPS 14.1-73.37 FIPS and later 14.1-FIPS releases, and 13.1-FIPS / 13.1-NDcPP 13.1-37.279 and later releases in those branches. The 13.1 fix arrived after that branch reached end of maintenance on 15 September 2026. Instances on 14.1-73.32 or 13.1-63.21, the builds that fixed CVE-2026-19490 in August, fall inside the affected range and need the new update.
Six further CVEs in the same bulletin cover request smuggling, a policy bypass, three memory overflow conditions and a TCP initial sequence number prediction weakness. Fixing only the two exploited issues leaves those in place.

If compromise is suspected

Citrix recommends preserving evidence from the VPX instance before rebuilding, isolating the device, revoking credentials and access, investigating every server and system the NetScaler was connected to, rebuilding with current firmware, and rotating local account passwords, key encryption keys and restored SSL certificates.
Two configuration points deserve attention. NetScaler Management Services should not be reachable from the internet. The management interface of a VPN concentrator is a authentication surface that gets scanned continuously, and a pre-authentication command injection lives near it in the same exposure class.

References

[1] Citrix security bulletin for CVE-2026-88771 through CVE-2026-88778, https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778
[2] CISA alert on the Citrix NetScaler zero-days, https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
[3] watchTowr Labs analysis of CVE-2026-88771, https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/