Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

watchTowr Labs details CVE-2026-88771, a pre-authentication command injection in Citrix NetScaler ADC and NetScaler Gateway that has already been abused as a zero-day in real attacks. The flaw sits in the diagnostic script ns_monuploadd_err.pl, which blindly pipes attacker-influenced log lines through shell commands (grep/sed/awk and backtick find) without sanitizing them, letting an unauthenticated attacker inject shell metacharacters into authentication requests (such as the login field) that get logged and later executed as root. Citrix bundled the fix with seven other vulnerabilities in bulletin CTX697096, rated 9.5 CVSS for this bug, and the researchers published a proof-of-concept and detection script confirming root-level command execution. Affected deployments should upgrade immediately to NetScaler/Gateway 14.1-73.37, 13.1-64.23, or the corresponding FIPS/NDcPP builds, since the vulnerability impacts the default configuration and any logging endpoint reachable pre-auth.