The original text is in EN, taken from the source site. Source ↗

Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled.

ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant.

Citrix disclosed the vulnerability on September 27, 2026, describing it as an improper input-validation vulnerability.

The vendor assigned a CVSS v4.0 score of 9.5; NVD lists the same score and confirms that an unauthenticated attacker can execute arbitrary commands.

Citrix says exploitation has been observed against unmitigated deployments, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

The requests were designed to place the encoded payload in HTTP access logs; the User-Agent content itself was not the execution trigger.

Attackers then submitted crafted login requests containing forged Packet Processing Engine failure messages.

Commands appended to the messages searched HTTP logs for the INDEX: marker, extracted and decoded the payload, and passed it to a shell.

ThreatLabz’s analysis said that, attackers separating payload delivery from execution. First, they sent GET requests to common NetScaler paths with a User-Agent beginning INDEX: and followed by Base64-encoded commands.

Attack chain exploiting CVE-2026-88771 to compromise NetScaler appliances (Source : Zscaler).

CERT-EU independently documented the same general technique: attacker-controlled content was planted in logs, then reached through vulnerable diagnostic processing.

The vulnerability lies in how a NetScaler diagnostic Perl script handles matching PPE failure records.

It searches system logs for messages such as “PPE missed too many heartbeats” or “PPE unexpectedly died,” then incorporates a selected record into a shell command without adequately escaping attacker-controlled content.

CERT-EU reported that the script selects the last matching entry, which helps explain repeated trigger attempts: attackers try to ensure their forged line is the one processed.

The decoded staged commands attempted to create files across several appliance web directories, enable PHP or Perl CGI, and install web-accessible scripts.

ThreatLabz also observed an inline command that downloaded and ran a Rust-based FreeBSD 64-bit binary.

These behaviors indicate an effort to establish command execution and persistence, but observed attempts alone do not prove that every targeted appliance was successfully compromised.

The FreeBSD payload was retrieved from infrastructure that ThreatLabz had also associated with attacks exploiting CVE-2026-75650, dubbed StyleSmuggler, in Adobe Commerce and Magento.

The overlap may point to shared operators, malware distribution infrastructure or reused hosting. It does not, by itself, establish that the same threat actor conducted both campaigns.

A separate Citrix issue, CVE-2026-107406, affects certain NetScaler appliances configured as SAML service providers or identity providers and can lead to RCE or denial of service.

Citrix’s bulletin specifies fixed builds including 14.1-73.46 and 13.1-64.29; organizations should assess that advisory separately rather than treating it as part of the CVE-2026-88771 attack chain.

For CVE-2026-88771, Citrix lists these fixed releases: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP.

Administrators should verify the applicable product branch and install the vendor-recommended build.

Before updating a potentially compromised appliance, preserve available forensic evidence, including relevant logs, support bundles, and core dumps.

Then isolate suspected systems as appropriate and investigate for suspicious INDEX: User-Agent values, forged PPE failure messages, unexpected web files, changes to HTTP configuration, suspicious processes and unfamiliar outbound connections.

If compromise is confirmed, rotate credentials and other secrets accessible through the appliance.

IOCs

Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.