Exploit / PoCcriticalExploited in the wild

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

watchTowr Labsby Benjamin HarrisSep 28, 2026 · 10:55 UTC (Sep 28, 2026)9 min read4 · 1 read

AI summary · glm-5.3Summaries by Vani AI

watchTowr details CVE-2026-88771, a pre-auth command injection in Citrix NetScaler ADC/Gateway patched in bulletin CTX697096 and already exploited as a zero-day.

watchTowr reverse-engineers CVE-2026-88771, a pre-auth command injection (CVSS 9.5) affecting the default configuration of Citrix NetScaler ADC and Gateway, which was exploited in the wild as a zero-day before any fix existed. The flaw is one of eight fixed in bulletin CTX697096, including memory-overflow RCE CVE-2026-88772 (also exploited) and HTTP request smuggling CVE-2026-88773. Diffing firmware 14.1-73.30 versus 14.1-73.37 revealed the root cause in Perl scripts (ns_monuploadd_err.pl) rather than the usual NSPPE binary. Fixed versions include NetScaler ADC/Gateway 14.1-73.37 and 13.1-64.23 plus FIPS builds.

Key facts

Pre-auth command injection CVSS 9.5 in default NetScaler config, exploited as zero-day
Eight CVEs fixed in CTX697096; memory overflow CVE-2026-88772 also exploited in wild
Root cause is unsafe shell commands in Perl scripts, not the NSPPE binary
Update to 14.1-73.37 or 13.1-64.23; FIPS builds also patched

Analyze CVE-2026-88771 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-88771 CVE-2026-88772 CVE-2026-88773 CVE-2026-88774 CVE-2026-88775 CVE-2026-88776 CVE-2026-88777 CVE-2026-88778

ATT&CK: T1190 Exploit Public-Facing Application

Tags: citrix netscaler cve-2026-88771 command-injection zero-day ctx697096 adc vpn-gateway

Organizations: Citrix watchTowr NetScaler

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-88771 +1 related CVE CVE-2026-88772	Unauthenticated RCE in Citrix NetScaler ADC and Gateway	9.5	82%	KEVPoC ×5	Sep 27, 2026 KEV Sep 27, 2026
CVE-2026-88773 +5 related CVEs CVE-2026-88776 CVE-2026-88775 CVE-2026-88777 CVE-2026-88778 CVE-2026-88774	HTTP request smuggling in Citrix NetScaler ADC and Gateway	9.3 group max	3%	PoC ×2	Sep 27, 2026

From the original article

9 min read at labs.watchtowr.com

God damn it, we're back in the room again. We'll probably write more here later, but for now, deal with this picture of our favorite software dev, who works at Citrix (we imagine). Citrix, before you ask, we do accept our new volunteer role as an

watchTowr Labs

By Benjamin Harris · labs.watchtowr.com

Read the full article at watchTowr Labs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.