Citrix NetScaler ADC/Gateway CVE-2026-88771 unauthenticated RCE exploited via log poisoning to drop web shells and FreeBSD implant
Attackers are actively exploiting CVE-2026-88771, a critical (CVSS v4.0 9.5) unauthenticated remote code execution flaw in Citrix NetScaler ADC and Gateway. The bug is an improper input-validation issue that needs no optional features enabled. Citrix disclosed it on September 27, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog. ThreatLabz observed log poisoning to trigger command execution, web shell deployment and attempts to run a Rust-based FreeBSD x64 implant. The payload was served from infrastructure that ThreatLabz had also linked to exploitation of CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento. The article says this overlap does not by itself prove the same actor ran both campaigns.
Entenda a falha
A vulnerabilidade
CVE-2026-88771 is a critical (CVSS v4.0 9.5) improper input-validation flaw in Citrix NetScaler ADC and Gateway. An unauthenticated remote attacker can run arbitrary commands, and no optional feature has to be enabled. It is exploited in the wild and is in CISA's KEV catalog. Fixed releases are 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP. The articles do not list the affected versions. CVE-2026-107406 is a separate flaw: it affects appliances configured as SAML SP or IdP, can lead to RCE or DoS, and is fixed in 14.1-73.46 and 13.1-64.29. It is not part of this attack chain.
Como funciona
A NetScaler diagnostic Perl script searches system logs for Packet Processing Engine failure messages such as "PPE missed too many heartbeats" or "PPE unexpectedly died". It picks the last matching entry and inserts it into a shell command. Attackers first send GET requests with a User-Agent starting with INDEX: and Base64-encoded commands, which are recorded in the HTTP access logs. They then send login requests carrying forged PPE failure messages. The script processes the forged line, and the commands appended to it search the HTTP logs for the INDEX: marker, decode the payload and pass it to a shell.
Por que é vulnerável
The root cause is improper input validation. The diagnostic script builds a shell command from a log record without adequately escaping attacker-controlled content. It also trusts that log lines resembling PPE failures are genuine, although an unauthenticated user can make the appliance write such lines through crafted requests. Because the script takes the last matching entry, attackers try to make sure their forged line is the one processed. The articles do not say why the flaw went unnoticed. The fix is in the releases listed by Citrix, but the articles do not describe what it changes.
Como foi descoberta
Citrix disclosed the flaw on September 27, 2026, and says it has seen exploitation against unmitigated deployments. CISA then added it to the KEV catalog. ThreatLabz observed the active exploitation (log poisoning, web shells and a Rust-based FreeBSD implant), and CERT-EU independently documented the same general technique. The articles do not say who first found the flaw or how it was reported to Citrix. ThreatLabz saw the payload served from infrastructure it had also linked to CVE-2026-75650 (StyleSmuggler) attacks on Adobe Commerce and Magento. That overlap does not by itself show the same actor was behind both campaigns.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 05:17.
Detalhes técnicos
- A NetScaler diagnostic Perl script searches system logs for PPE failure messages such as "PPE missed too many heartbeats" or "PPE unexpectedly died". It inserts the selected record into a shell command without adequately escaping attacker-controlled content. CERT-EU reports that the script picks the last matching entry, which explains the repeated trigger attempts.
- Payload delivery and execution are separate steps. Attackers first send GET requests to common NetScaler paths with a User-Agent beginning
INDEX:followed by Base64-encoded commands, which land in the HTTP access logs. They then submit crafted login requests containing forged PPE failure messages. Appended commands search the HTTP logs for theINDEX:marker, decode the payload and pass it to a shell. - Decoded staged commands tried to create files in several appliance web directories, enable PHP or Perl CGI and install web-accessible scripts. An inline command downloaded and ran a Rust-based FreeBSD 64-bit binary.
- Observed attempts do not prove that every targeted appliance was compromised.
- CERT-EU independently documented the same general technique.
- CVE-2026-107406 is a separate Citrix issue affecting NetScaler appliances configured as SAML SP or IdP (RCE or DoS). It has its own fixed builds (14.1-73.46, 13.1-64.29) and is not part of this attack chain.
Remediação
- Upgrade to the fixed releases for CVE-2026-88771: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP. Verify the product branch first.
- Before updating a potentially compromised appliance, preserve logs, support bundles and core dumps.
- Isolate suspect systems and hunt for
INDEX:User-Agent values, forged PPE failure messages, unexpected web files, HTTP configuration changes, suspicious processes and unfamiliar outbound connections. - If compromise is confirmed, rotate credentials and other secrets accessible through the appliance.
Linha do tempo
-
Citrix NetScaler ADC/Gateway CVE-2026-88771 unauthenticated RCE exploited via log poisoning to drop web shells and FreeBSD implant
ler a análise desta fonte ocultar
Attackers are actively exploiting CVE-2026-88771, a critical (CVSS v4.0 9.5) unauthenticated remote code execution flaw in Citrix NetScaler ADC and Gateway. The bug is an improper input-validation issue that needs no optional features enabled. Citrix disclosed it on September 27, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog. ThreatLabz observed log poisoning to trigger command execution, web shell deployment and attempts to run a Rust-based FreeBSD x64 implant. The payload was served from infrastructure that ThreatLabz had also linked to exploitation of CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento. The article says this overlap does not by itself prove the same actor ran both campaigns.
Technical Details
- A NetScaler diagnostic Perl script searches system logs for PPE failure messages such as "PPE missed too many heartbeats" or "PPE unexpectedly died". It inserts the selected record into a shell command without adequately escaping attacker-controlled content. CERT-EU reports that the script picks the last matching entry, which explains the repeated trigger attempts.
- Payload delivery and execution are separate steps. Attackers first send GET requests to common NetScaler paths with a User-Agent beginning
INDEX:followed by Base64-encoded commands, which land in the HTTP access logs. They then submit crafted login requests containing forged PPE failure messages. Appended commands search the HTTP logs for theINDEX:marker, decode the payload and pass it to a shell. - Decoded staged commands tried to create files in several appliance web directories, enable PHP or Perl CGI and install web-accessible scripts. An inline command downloaded and ran a Rust-based FreeBSD 64-bit binary.
- Observed attempts do not prove that every targeted appliance was compromised.
- CERT-EU independently documented the same general technique.
- CVE-2026-107406 is a separate Citrix issue affecting NetScaler appliances configured as SAML SP or IdP (RCE or DoS). It has its own fixed builds (14.1-73.46, 13.1-64.29) and is not part of this attack chain.
Remediation
- Upgrade to the fixed releases for CVE-2026-88771: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP. Verify the product branch first.
- Before updating a potentially compromised appliance, preserve logs, support bundles and core dumps.
- Isolate suspect systems and hunt for
INDEX:User-Agent values, forged PPE failure messages, unexpected web files, HTTP configuration changes, suspicious processes and unfamiliar outbound connections. - If compromise is confirmed, rotate credentials and other secrets accessible through the appliance.