Key Takeaways CVE-2026-88771 is a pre-authentication command injection in Citrix NetScaler ADC and Gateway that grants root command execution. Attackers exploited the flaw as a zero-day, and CISA added it to the KEV Catalog on September 27, 2026. The bug resides in ns_monuploadd_err.pl , a root Perl maintenance script that passes log line content to the shell.
CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained
calendar_today
October 13, 2026
person
umut.bayram@picussecurity.com (Umut Bayram)
domain
picus-security