Loading vulnerability…
CVE-2026-88771 is an improper input-validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway that permits unauthenticated remote command execution. Attacker-controlled authentication input reaches logging and error-processing mechanisms and is interpreted as part of a shell command, reportedly enabling root-level execution. The vulnerability affects default configurations without requiring additional features. Affected releases include ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, ADC 14.1-FIPS before 14.1-73.37 FIPS, and ADC 13.1-FIPS and NDcPP before 13.1-37.279. Active exploitation began before patches were available.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (10 hidden).
This is a standalone exploit-analysis and evidence repository for CVE-2026-88771, not a framework module. It documents a cross-component, pre-auth root command-injection chain affecting Citrix NetScaler ADC 14.1-66.59 and 14.1-72.61. An unauthenticated NITRO login POST accepts a username with only a less-than-128-byte length check. A failed login is recorded in /var/log/ns.log, and the root-run admautoregd telemetry worker periodically calls ns_monuploadd_err.pl -WR. In vulnerable builds, that Perl branch extracts an NSPPE-related token from logs using grep/sed/awk and interpolates it unquoted into a backtick-executed find command, allowing shell syntax from the logged input to run as root. The claimed fix in 14.1-73.37 removes the production PE-failure caller and replaces shell-based parsing/execution with strict parsing and argument-vector invocation. The tree primarily contains Markdown investigation reports, firmware hashes, Ghidra decompilations, Python/Perl/PHP/shell evidence, and old/new mastools telemetry sources. README and analysis files reference working and weaponized PoCs under poc/, but those PoC files are not included in the supplied file inventory; the included SAFE_LOG_PARSER_REPRO.md is deliberately non-executing. Static evidence is detailed and internally consistent; the stated live root-marker validation remains operator-reported because supporting request, log, trace, and stat artifacts are absent.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
543 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as background in reports of active exploitation to deploy web shells and tunneling tools on compromised systems. The article does not specify this vulnerability's technical mechanism, affected product versions, or remediation.
Mentioned as background to the main vulnerability disclosure. Active exploitation reportedly involved planting web shells and tunneling tools on compromised systems. The content does not specify this vulnerability's technical mechanism, affected products, or remediation.
A previously disclosed, actively exploited NetScaler vulnerability referenced in the earlier security bulletin. Updates addressing it do not protect SAML-enabled deployments against CVE-2026-88779. The primary content does not specify its technical mechanism.
Referenced only as part of a prior NetScaler security bulletin's CVE range. The content does not describe this vulnerability's technical nature or individual impact.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.