CVE-2026-88771: From a Failed NetScaler Login to a Shell

Tue, 29 Sep 2026 08:00:00 +0200

CVE-2026-88771 is a critical, unauthenticated command-execution vulnerability in NetScaler ADC and NetScaler Gateway. Citrix says that every customer-managed deployment is exposed, including the default configuration, and that exploitation has been observed.

The public bulletin gives defenders the important part: upgrade now. It does not explain how hostile input becomes a command. Comparing NetScaler 14.1 builds 73.30 and 73.37 fills in much of that gap.

On 73.30, an unauthenticated client can place shell syntax in the username of a failed management login. The appliance writes that username to /var/log/ns.log. A later warm-restart diagnostic pass can mistake the record for an NSPPE crash event, derive a supposed core-file name from attacker text, and interpolate it into a Perl backtick command. The backticks invoke a shell, so a filename becomes code.

That source-to-shell path is real. A harmless file-writing canary demonstrated command execution in an isolated lab when the original script was explicitly invoked with -WR. The same input remained inert on 73.37, where Citrix replaced the permissive parser and shell-based find invocation.

There is one important boundary: the login request does not itself launch the diagnostic script. Three genuine packet-engine recovery tests did not produce an observed -WR invocation. A parser-shaped username is therefore strong evidence of an exploitation attempt, but not by itself proof that commands ran.

CVE-2026-88771 on Martin's Blog

CVE-2026-88771: From a Failed NetScaler Login to a Shell