RST Cloud on X: "#threatreport #LowCompleteness CVE-2026-88771: Inside the ...

CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability | 16-10-2026

🎯Victims: Netscaler adc, Netscaler gateway, Adobe commerce, Magento open source

- citrix netscaler_application_delivery_controller (<13.1-64.23, <13.1.37.279, <14.1-73.37)

- citrix netscaler_gateway (<13.1-64.23, <14.1-73.37)

- adobe commerce (<2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8)

T1033, T1059.004, T1082, T1105, T1190, T1505.003, T1565.001

CVE-2026-88771 is a critical unauthenticated remote code execution vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Exploitation does not require optional features or authentication and allows attackers to execute arbitrary commands on vulnerable appliances. Citrix confirmed exploitation of unpatched systems, and the vulnerability was reportedly added to CISA’s Known Exploited Vulnerabilities catalog. Fixed releases include NetScaler 14.1-73.46 and later, 13.1-64.29 and later, and specified 13.1-FIPS and 13.1-NDcPP releases beginning with 13.1.37.283.

Observed attacks used access-log poisoning followed by delayed command execution. Attackers created multiple directories and wrote forged PPE failure records containing system-identification commands, including `id`, `uname`, hostname, and NetScaler release information. The records were placed in several appliance web and VPN directories, while additional PHP and Perl files were created with executable permissions. The attackers modified Apache configuration to enable PHP and Perl CGI handlers and reloaded the web server.

The poisoned authentication data was written to `/var/log/ns.log`. NetScaler’s legitimate Perl diagnostic script, `/netscaler/ns_monuploadd_err.pl`, later processed a forged Packet Processing Engine failure record. Because attacker-controlled content was incorporated into a shell command without adequate escaping, shell metacharacters caused commands to execute with the script’s privileges.

Several exploitation variants attempted to deploy web shells or retrieve malware. One command downloaded a Rust-based 64-bit FreeBSD executable to `/var/kw2s11`, changed its permissions, and executed it. The payload was identified as `kw2-freebsd-x64-s11`. Attackers also sprayed files across multiple URL paths to improve persistence or execution opportunities. The download infrastructure overlapped with activity involving the unrelated StyleSmuggler vulnerability, CVE-2026-75650, although the overlap does not establish common attribution.

The key diagram for the report (ML Classifier):