Description
NetScaler ADC and Gateway 13.1 before build 64.23 and 14.1 before build 73.37 copy an unauthenticated failed-login username into system logs. During a later diagnostic run, ns_monuploadd_err.pl mistakes a crafted login record for a packet-engine failure and inserts attacker-controlled text into a shell command as root. The diagnostic can run up to 24 hours later. On a NetScaler Gateway with DTLS, the optional CVE-2026-88772 trigger can restart the packet engine forcing the diagnostic run to occur much sooner (around five minutes on a 13.1.x target).
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/freebsd/http/citrix/netscaler_cve_2026_88771msf undefined(netscaler_cve_2026_88771) > show actions ...actions...msf undefined(netscaler_cve_2026_88771) > set ACTION < action-name >msf undefined(netscaler_cve_2026_88771) > show options ...show and set options...msf undefined(netscaler_cve_2026_88771) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub