CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. Exploitation requires no optional features to be enabled.Citrix confirmed exploitation on unmitigated appliances, and the US’s Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog following reports of active exploitation worldwide. Citrix has since disclosed another critical vulnerability affecting NetScaler ADC and NetScaler Gateway, CVE-2026-107406, which can lead to RCE or denial of service. CVE-2026-107406 affects appliances configured as SAML service provider or identity provider depending on the software version. The analysis in this blog focuses on the exploitation of CVE-2026-88771.Zscaler ThreatLabz observed a staged exploitation chain involving access-log poisoning, remote command execution before authentication, appliance fingerprinting, and attempts to deploy multiple web shells. ThreatLabz also observed delivery of a FreeBSD x64 implant from infrastructure that overlapped with activity we previously associated with exploitation of StyleSmuggler (CVE-2026-75650), a vulnerability affecting Adobe Commerce and Magento.This overlap provides an investigative lead but does not establish threat actor attribution. Shared hosting and compromised infrastructure, malware distribution services, or payload reuse by unrelated operators could explain the connection. Fixed ReleasesCitrix recommends installing the following builds or later:Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.46 and later releasesCitrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.29 and later releases of 13.1Citrix NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPSCitrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP RecommendationsOrganizations running NetScaler ADC or NetScaler Gateway should take the following actions immediately:Identify exposed appliances: Inventory every NetScaler appliance and determine its software version, build, and internet exposure.Preserve forensic evidence before updating: Capture a virtual machine snapshot, where applicable, and collect remote syslog data, the NetScaler technical support bundle, and available packet-engine core dumps. CISA warns that updating may remove or reduce forensic visibility.Isolate potentially compromised appliances: Remove potentially compromised appliances from untrusted networks while preserving evidence.Mitigation and response: If your environment includes any of the impacted appliances, it is advisable to proactively hunt for signs of compromise. The following commands, sourced from Sh3llc0de, can help identify suspicious activity.To investigate modifications within the FreeBSD shell, access the NetScaler console, enter shell, and run the commands below:#1. Inspect running processes for suspicious shells spawned by nsppe
ps aux | grep -E "sh|bash|python|perl|nc|curl|wget" | grep -v "nsconmsg"

# 2. Check startup script rc.netscaler for unauthorized modifications
cat /flash/nsconfig/rc.netscaler

# 3. Audit cron jobs for suspicious automated scripts
crontab -l
cat /etc/crontab

# 4. Search for newly created or modified web files in webroot directories
find /netscaler/ns_gui/ -type f -mtime -3
find /var/netscaler/gui/ -type f -mtime -3

# 5. Review HTTP error logs for abnormal crash dumps or core files
ls -la /var/crash/
ls -la /var/core/To determine whether any unauthorized child shells have been launched under the /nobody/ service account, run the following:# Inspect active processes spawned by the nobody service context
ps aux | grep -E "(sh|bash|python|perl|nc)"

# Audit active network listening sockets for unmapped ports
netstat -an | grep LISTENCheck configuration integrity: Compare /etc/httpd.conf and other appliance configuration files with those on a known-good system. Pay particular attention to unexpected PHP or CGI enablement.Search for staged payloads: Look for INDEX: followed by Base64-encoded content in HTTP access logs.Search for forged failure messages: Review authentication and system logs for fabricated pitboss PPE messages containing shell syntax.Review outbound connections: Investigate appliance-initiated connections, especially downloads from unfamiliar IP addresses.Rotate exposed secrets after containment: If compromise is confirmed, rotate credentials, tokens, certificates, and other secrets stored on or accessible through the appliance.Upgrade to a fixed release: Install the applicable Citrix build listed above. Attack ChainThe figure below

Read the original article:

CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability