# Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Unauthenticated RCE in Citrix NetScaler via log-poisoning command injection and DTLS memory overflow, exploited in the wild to drop PHP web shells.

- Payout: Real-world hack
- Severity: critical
- Program: Citrix NetScaler
- Credited: Unit 42
- Disclosed: 2026-09-30
- CVE: CVE-2026-88771, CVE-2026-88772
- Write-up quality: 8/10
- Original: https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited
- Tags: domain:network impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:linux technique:second-order vuln:command-injection vuln:dos vuln:memory-corruption vuln:rce

**Target:** NetScaler ADC / NetScaler Gateway appliances (HTTP admin UI, DTLS, Perl log-processing script)
**Root cause:** CVE-2026-88771: attacker-controlled text injected into ns.log (via User-Agent and failed-login messages) is later parsed by /netscaler/ns_monuploadd_err.pl, which extracts text after NSPPE and executes it as a shell command. CVE-2026-88772: crafted DTLS packets cause memory corruption in the DTLS handler.
**Steps:**
1. Fingerprint version via `GET /admin_ui/common/css/ns/ui.css` and `/vpn/js/rdx/core/lang/rdx_en.json.gz`.
2. Stage 1: send HTTP request with Base64 dropper in `User-Agent`; 404 response logs it to `/var/log/httpaccess-vpn.log`.
3. Stage 2: submit login request with failure text `pitboss PPE missed too many heartbeatsNSPPE;<additional text>` logged to `/var/log/ns.log`.
4. Stage 3: when `/netscaler/ns_monuploadd_err.pl -WR` runs, it extracts text after NSPPE and executes it; payload greps the Base64 from the access log, decodes, pipes to `sh`/`php`.
5. Payload runs `chmod 6555 /bin/sh` for SUID root, `mkdir -p /var/netscaler/logon/LogonPoint/custom`, drops `.ctxs.receiver` PHP shell.
6. Patch `/etc/httpd.conf` via `perl -ni -e` to add `<Files ".ctxs.receiver">` block and Alias/AliasMatch serving shell as `receiver.min.css`; flip `php_flag engine off` to `on`; `kill -HUP \`cat /var/run/httpd.pid\``.
7. Interact with shell via `CsrfToken=e826d7ddf3c85920` cookie and URL-encoded command in `NSC_TASS` cookie.
**How found:** Not stated; write-up is incident response analysis of observed exploitation, not discovery reasoning.
**Exploitation:** Unauthenticated attacker poisons logs to trigger command execution as root on NetScaler, then drops a PHP web shell disguised as a CSS asset under the Gateway UI root, enabling persistent RCE, file exfil and upload. Separate DTLS chain drops .deb PHP web shells (RC4 key MD5 of Rhfajaf1H992) using /var/netscaler/.ns_suidcmd for privesc.
**Escalation:** SUID bit on /bin/sh plus .ns_suidcmd binary raises web shell to root; Apache config patch hides shell behind legitimate-looking CSS path and enables PHP engine.
**Insight:** Log files consumed by privileged scripts are an injection surface: taint from User-Agent and failed-login messages reached a Perl log processor that shell-executed text after a fixed token (NSPPE). Hunt for fixed sentinel strings in logs whose trailing content is later executed.