Exploited Citrix NetScaler Command Injection Enables Unauthenticated Root Access
Active Exploitation · 8 sources · Updated 16d ago · First seen Oct 13, 2026
A pre-authentication command-injection vulnerability, CVE-2026-88771, affects Citrix NetScaler ADC and NetScaler Gateway and reportedly allows remote attackers to execute commands as root in the default configuration. Picus Security reports that attackers can submit crafted usernames through unauthenticated login requests, placing malicious content into appliance logs. The root-running maintenance script ns_monuploadd_err.pl subsequently incorporates unsanitized log-derived data into a shell command, allowing an injected semicolon to introduce attacker-controlled commands.
According to the report, attackers exploited the flaw as a zero-day, with worldwide exploitation confirmed, and CISA added it to the Known Exploited Vulnerabilities Catalog on September 27, 2026. The unauthenticated attack path and root-level impact make exposed appliances a priority for remediation and compromise assessment. Organizations should verify applicable vendor advisories and fixes, restrict unnecessary external access, and investigate suspicious login inputs and unexpected command execution associated with the maintenance script. The supplied reporting does not identify affected release ranges or fixed versions.
