Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

Key Points:

• A critical pre-auth command injection vulnerability (CVE-2026-88771) in Citrix NetScaler Gateway was actively exploited in the wild before Citrix acknowledged or patched it, affecting default configurations and allowing unauthenticated remote code execution.
• The root cause was improper input validation in a Perl script (ns_monuploadd_err.pl) that processed log files insecurely, enabling attackers to inject shell commands executed with root privileges due to unsafe use of shell commands and insufficient sanitization.
• Citrix’s patch replaced unsafe shell command chains with strict regex validation and safer Perl system calls, preventing shell metacharacter injection and enforcing strict filename patterns to mitigate the vulnerability.
• The vulnerability could be triggered remotely via specially crafted HTTP requests containing malicious log entries, affecting multiple endpoints including the management interface, and allowing attackers to execute arbitrary commands as root.
• watchTowr security researchers provided early warnings, active defense measures, and detection tools to clients, criticizing Citrix for delayed communication and patching, and highlighting the importance of rapid and transparent vulnerability management in critical infrastructure products.