CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained

Key Takeaways

• CVE-2026-88771 is a pre-authentication command injection in Citrix NetScaler ADC and Gateway that grants root command execution.
• Attackers exploited the flaw as a zero-day, and CISA added it to the KEV Catalog on September 27, 2026.
• The bug resides in ns_monuploadd_err.pl, a root Perl maintenance script that passes log line content to the shell.
• Attackers plant payloads by submitting a crafted username in an unauthenticated login request, which NetScaler writes to its logs.
• A semicolon in the injected text splits the find command, so the attacker's command runs as root.
• The Picus Platform simulates CVE-2026-88771 attacks so teams can validate the effectiveness of their security controls against this vulnerability.
  

CVE-2026-88771 is a pre-authentication command injection in Citrix NetScaler ADC and NetScaler Gateway that lets a remote attacker run commands as root. It works in the default configuration, and attackers were exploiting it as a zero-day before a fix existed. CISA added it to its Known Exploited Vulnerabilities (KEV) Catalog on September 27, 2026, after confirming active exploitation around the world [1].

The bug is not in a login handler or a parser. It sits in a background Perl maintenance script that reads the appliance's own log files and passes part of a log line to the shell. Anything an attacker can get written into the logs, such as a username on the login page, becomes a command waiting to run.

In this blog, we explain CVE-2026-88771 and how Picus simulates it to validate your controls.

What is Citrix NetScaler?

Citrix NetScaler is a family of network appliances that sit at the edge of large enterprise networks. NetScaler ADC (Application Delivery Controller) handles load balancing, SSL offloading, and authentication for web applications. NetScaler Gateway is the remote access piece. It is the VPN and login portal employees use to reach internal systems from outside.

That position increases the impact of NetScaler vulnerabilities. The appliance faces the internet by design, accepts traffic from anyone before they log in, and holds sessions, credentials, and certificates for the network behind it. Under the hood, it runs a FreeBSD-based system where most services run as root, so a single command injection usually means full control of the appliance.

Two internal components matter for this vulnerability:

• NSPPE (NetScaler Packet Processing Engine) is an internal process inside the appliance, not a separate product. It handles the appliance's network traffic. An appliance runs one or more instances, named NSPPE-00, NSPPE-01, and so on.
• Pitboss is a watchdog that monitors the Packet Engines. When one hangs or crashes, Pitboss writes a log line such as pitboss: NSPPE-00 (12345) unexpectedly died, and the system saves a core dump for troubleshooting.

How CVE-2026-88771  Works?

The attack has two halves. First, the attacker plants a payload in the logs, and later a root maintenance script reads that payload back and hands it to the shell [2].

The vulnerable script

ns_monuploadd_err.pl collects crash information. One of its jobs is to find the core dump of a Packet Engine that crashed. To do that, it searches the log files for a Pitboss crash message and builds a core file name from it. The vulnerable code looks like this [2].

In Perl, text inside backticks is run as a shell command. The first command is a small pipeline with four steps.

1. grep searches the logs for a line that looks like a Pitboss crash message.
2. tail -1 keeps only the last matching line.
3. sed cuts everything before the word NSPPE and removes the parentheses.
4. awk takes the first two words and joins them with a hyphen.

For a real crash line, pitboss: NSPPE-00 (12345) unexpectedly becomes NSPPE-00-12345, which is the core file name. The second line then runs find to locate that file.

Unsanitized Log Data in a Backtick Shell Command

The script never checks that the two words it extracted are really a Packet Engine name and a numeric process ID. It trusts whatever text follows NSPPE on the matching line. And it does not care who wrote that line. The grep pattern matches any log entry containing pitboss, PPE, and unexpectedly died, in that order.

Suppose a log line contains this text. 

After sed and awk, the variable holds the following value.

At this stage, nothing has run. The semicolons are only characters in a string. The injection happens on the next line, where Perl inserts that string into the find command. The shell receives the following command.

In the shell, a semicolon separates commands. So it runs find, then runs id>/tmp/poc (the attacker's command), then tries to run -X*, which fails. This error does not affect the result, because the injected command has already run as root.

How the Attacker Plants the Malicious Log Line

The attacker needs a log line they control. NetScaler logs many request fields before authentication, so this requirement is simple to meet. The simplest route is the login form. The attacker sends a normal unauthenticated login request to the Gateway (for example, a POST to /nf/auth/doAuthentication.do) with the payload as the username. The username field contains text shaped like the crash message above, followed by a shell command.

The appliance does what it always does with a failed login and writes the username to its logs. The resulting entries look like this [2].

The login page is not the only path either. Any field that ends up in the logs can carry the payload.

When the script runs, the full chain looks like this.

1. The attacker sends an unauthenticated request with a crafted value, such as a username.
2. NetScaler writes that value into its log files.
3. ns_monuploadd_err.pl runs as root and its grep matches the fake Pitboss crash line.
4. sed and awk pull the attacker's text into the core file name variable.
5. Perl builds the find command as a string and passes it to the shell.
6. The shell sees the semicolon and runs the attacker's command as root.
   

How Picus Simulates CVE-2026-88771 Attacks?

We also strongly suggest simulating CVE-2026-88771 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2026-88771 attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] Cybersecurity and Infrastructure Security Agency (CISA), "Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC, Gateway," CISA Alerts, Sep. 27, 2026, updated Oct. 9, 2026. [Online]. Available: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway. [Accessed: Oct. 12, 2026].

[2] watchTowr Labs, "Oh look! The foot gun went off again (Citrix NetScaler pre-auth command injection CVE-2026-88771)," watchTowr Labs, Sep. 2026. [Online]. Available: https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/. [Accessed: Oct. 12, 2026].