CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained

Key Takeaways

  • CVE-2026-88771 is a pre-authentication command injection in Citrix NetScaler ADC and Gateway that grants root command execution.
  • Attackers exploited the flaw as a zero-day, and CISA added it to the KEV Catalog on September 27, 2026.
  • The bug resides in ns_monuploadd_err.pl, a root Perl maintenance script that passes log line content to the shell.
  • Attackers plant payloads by submitting a crafted username in an unauthenticated login request, which NetScaler writes to its logs.
  • A semicolon in the injected text splits the find command, so the attacker's command runs as root.
  • The Picus Platform simulates CVE-2026-88771 attacks so teams can validate the effectiveness of their security controls against this vulnerability.

CVE-2026-88771 is a pre-authentication command injection in Citrix NetScaler ADC and NetScaler Gateway that lets a remote attacker run commands as root. It works in the default configuration, and attackers were exploiting it as a zero-day before a fix existed. CISA added it to its Known Exploited Vulnerabilities (KEV) Catalog on September 27, 2026, after confirming active exploitation around the world [1].

Article Link: CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained