Executive Summary
In September 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability in NetScaler ADC and Gateway with a CVSS score of 9.8. Threat actors are actively exploiting this flaw globally, leading to its inclusion in CISA's Known Exploited Vulnerabilities catalog. The exploitation involves a sophisticated two-step log poisoning attack chain that bypasses authentication to execute arbitrary commands with system privileges.
Technically, attackers stage a Base64-encoded payload in HTTP access logs via crafted User-Agent strings and subsequently trigger its execution by poisoning authentication logs with forged Packet Processing Engine (PPE) failure records. These records are then processed by a vulnerable internal Perl script, `/netscaler/ns_monuploadd_err.pl`, which executes the appended shell commands. Observed payloads include appliance fingerprinting, enabling PHP/Perl CGI, and deploying FreeBSD-based implants (kw2-freebsd-x64-s11) via overlapping infrastructure previously linked to Adobe Commerce (StyleSmuggler) exploitation.
This threat poses a severe risk to any organization using NetScaler for remote access or load balancing. Successful compromise allows for persistent web shell access, lateral movement, and complete appliance takeover. Citrix and CISA strongly recommend immediate patching and forensic preservation, as the upgrade process may overwrite critical artifacts needed for compromise assessment.