Citrix NetScaler ADC and Gateway (CVE-2026-88771)

On Sunday 27 September 2026 Citrix patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway. Two were already being exploited, and by then attackers had been inside some networks for more than three weeks. CVE-2026-88771 needs nothing more than a reachable appliance.

What is CVE-2026-88771

NetScaler ADC and Gateway usually sit at the very front of the network, handling VPN and application access. CVE-2026-88771 is a command injection in a maintenance script. As CERT-EU worked out, the script ns_monuploadd_err.pl periodically searches the appliance’s logs for a specific error message and pastes part of the matching line unquoted into a shell command. An attacker can write that line themselves: a login attempt with a crafted username lands in the log as exactly that error, followed by shell commands. The next time the script runs, they execute as root.

Citrix classifies the flaw as improper input validation (CWE-20) and publishes only a CVSS v4.0 score of 9.5. NVD rates it 9.8 on CVSS v3.1.

What the attackers did

According to eSentire, the flaw was exploited as a zero-day from as early as 5 September. The attackers used it to enable PHP on the appliance and plant a webshell reachable from the internet. In one intrusion eSentire investigated, the webshell was in use from that day with signs of data exfiltration, after which the attacker opened sessions on internal virtual desktops.

The companion flaw CVE-2026-88772, a memory overflow in the DTLS handling, was abused in the same period. Mandiant and Google Threat Intelligence Group attribute its exploitation since early September to suspected state-linked actors, without naming a group. Researcher Kevin Beaumont reported on 28 September tracking more than 100 victim organisations. As of 1 October 2026, exploitation is ongoing.

In Europe, CERT-EU traced the flaw after the European Court of Auditors and the European Central Bank spotted the attackers’ requests in their logs. Germany’s BSI warns at level 3 (orange) and counts several thousand affected appliances in Germany alone. The Dutch central government disconnected Citrix environments from the internet as a precaution.

A log file is input too

Log files feel internal and trustworthy, and that is the mistake. Almost everything in a log was typed by someone else: a username, a URL, a User-Agent. Code that feeds a log line to a shell has a command injection with one extra step. According to watchTowr’s analysis, the patched script parses the log in Perl, accepts only a strict pattern and runs the command without a shell.

And as with Citrix Bleed, on an edge device a patch closes the door but does not remove whoever already came in.

What to do now

• Update to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1-37.279 (FIPS and NDcPP), or later.
• Before updating, secure the logs and a memory dump, as the Dutch NCSC advises, so that evidence of earlier abuse survives.
• Check for compromise with Citrix’s indicators and review logs back to early September. Unknown files under /var/netscaler/logon/LogonPoint/custom/ and a modified httpd.conf are strong signals.
• If you find traces, follow Citrix’s guidance for compromised appliances: rebuild rather than just patch, rotate passwords and secrets, revoke the certificates stored on the appliance and investigate every system it connected to.