Citrix NetScaler Zero-Day Enables Pre-Auth Root Command Execution

Summary

CVE-2026-88771 lets unauthenticated attackers execute commands as root on Citrix NetScaler ADC and Gateway by injecting payloads through logged login requests. The flaw was exploited as a zero-day and added to CISA’s KEV Catalog.

Key points

The flaw affects Citrix NetScaler ADC and Gateway and reportedly works in the default configuration.
Attackers can submit a crafted username in an unauthenticated login request, causing payload text to be written to appliance logs.
A root Perl maintenance script processes matching log entries and inserts attacker-controlled text into a shell command.
A semicolon in the injected text can separate commands, allowing the attacker’s command to run as root.
The article says attackers exploited the flaw as a zero-day and CISA added it to the KEV Catalog on September 27, 2026.
Picus describes a platform simulation for testing security controls against the vulnerability.

Article Details

Attack Vectors: An unauthenticated attacker submits a crafted username in a NetScaler Gateway login request; the value is written to appliance logs.
The root script ns_monuploadd_err.pl reads attacker-controlled log content and inserts it into a shell command. A semicolon in the injected text separates commands, enabling command execution as root.
Defensive Notes: The article recommends simulating CVE-2026-88771 attacks with the Picus Platform to test security-control effectiveness.
The article reports that CISA added CVE-2026-88771 to the KEV Catalog on 2026-09-27; it does not provide patching or configuration-remediation steps.