Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

Affected versions and fixed builds

The summary names CVE-2026-88771 and CTX697096 but not the version boundaries. Citrix fixed eight vulnerabilities in that bulletin; CVE-2026-88771 (the default-config, exploited-in-wild pre-auth RCE analyzed here) is paired with a second zero-day, CVE-2026-88772. Fixed releases:

• NetScaler ADC & Gateway 14.1-73.37 and later
• NetScaler ADC & Gateway 13.1-64.23 and later (13.1 branch)
• ADC 14.1-FIPS 14.1-73.37 FIPS and later
• ADC 13.1-FIPS / 13.1-NDcPP 13.1-37.279 and later

watchTowr's diff compared vulnerable build 14.1-73.30 against fixed 14.1-73.37.

The trigger is delayed, not immediate

This is the operationally important detail the summary omits. The injection does not fire when the poisoned log line is written — it fires only when the crash-log parser ns_monuploadd_err.pl next runs, which can take up to 24 hours. An attacker (or a defender testing) can force execution:

/netscaler/ns_monuploadd_err.pl -WR

watchTowr states they found a technique to force the parser to fire instantly (used by their tool's "force pickup") but are withholding it.

Injection surface is broad

The exploit is not tied to doAuthentication.do. Any endpoint or port that writes attacker-controlled HTTP data into the logs can seed the payload: failed logins, rate-limited/blocked users, request parameters, and User-Agent headers. The Citrix management interface is also reachable. The malicious log record needs the literal marker text after NSPPE, e.g.:

pitboss PPE unexpectedly died NSPPE;:`id>/var/tmp/watchTowr`;# X

Detection

watchTowr's Detection Artefact Generator (GitHub, by Sina Kheirkhah / @SinSinology) both poisons the logs and triggers pickup:

./watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py --target https://all-ur-boxen/ --command 'id>/var/tmp/watchTowr'

Caveats

watchTowr broadcast active-exploitation warnings before Citrix acknowledged the issue and advised taking appliances offline — treat their exploited-in-wild claim as vendor-attributed, not independently confirmed here. They also flag a "slop generated" impersonation post circulating under their name on another site.