NetScaler: a hidden command in logs and an overflowed DTLS buffer

Citrix advisory dated September 27, 2026. Two vulnerabilities in NetScaler ADC and Gateway, CVE-2026-88771 and CVE-2026-88772, each allowed remote code execution without authentication and were observed in exploitation. They have different root causes. The first passes client-controlled log data into a shell command; the second copies an oversized chain of DTLS buffers into a fixed buffer. watchTowr’s patch analyses explain both mechanisms beyond the CVE descriptions.

CVE-2026-88771: log is not a trusted source

NetScaler writes information from HTTP requests to its logs, including connection values. A maintenance Perl script, ns_monuploadd_err.pl, then searched for pitboss crash messages to find the name of an engine core dump nsppe. In the old version, it extracted a fragment of the log by a sequence grep, sed and awk, then reinjected the result into another shell command constructed as a string.

The first transformation just produced text. The danger materialized on the second use: a value supposed to be a file name became part of find ... -name <value>... executed by the shell. If attacker-controlled metacharacters survived extraction, the shell interpreted them as a new instruction. The diff and watchTowr demonstration shows precisely this transition. The hostile data changed status twice: first HTTP request to log, then log to privileged command.

The lab’s PoC causes an entry resembling the desired message to be written using a login field, then observes a verification command run with the identity root. The maintenance script does not necessarily execute at the time of the request: watchTowr specifies that you may have to wait for the script to run. This delay does not protect the machine; it only complicates the temporal association between the malicious request and its effect. The researcher also notes that other HTTP fields logged in the logs may constitute the source, which makes a rule limited to a single endpoint fragile.

The fix narrows the extraction to a numeric engine name and process ID, then calls find passing it distinct arguments, without rebuilding a line for /bin/sh to interpret. Both changes matter: validating a fragment helps, but removing shell reinterpretation closes the most dangerous trust boundary.

CVE-2026-88772: logical size and real size diverge

The second flaw is in the DTLS processing, TLS over UDP. A handshake message can arrive in fragments. Each fragment announces the size of the complete message, its offset and its useful length. The engine also stores the received bytes in a chain of NSB buffers. watchTowr compared builds 14.1-73.30 and 14.1-73.37 and found that before fixing, a function copied the entire NSB buffer chain into a fixed temporary buffer of 35,840 bytes without checking its cumulative size.

The laboratory demonstration manipulates the difference between “a fragment contributes a useful byte to the handshake” and “its network buffer retains almost the entire record”. A series of fragments can satisfy the logic of reassembling a short message while still accumulating approximately 174 KB of data in the buffer chain to be copied. Copying this chain then greatly exceeds the 35,840 byte buffer. The cause is a mismatch between the reconstructed logical length and the actual amount of bytes that the next function copies.

The fix maintains a counter of remaining space, compares the size of each NSB before memcpy, then decrements the counter after each copy. The bounds check now applies to the actual bytes copied. Citrix classifies the effect as RCE or denial of service; reproducible memory corruption establishes the primitive, while a code execution chain depends on memory state and concrete exploitation. The laboratory publishes a demonstration of overflow; we do not infer that every DTLS request causes a reliable takeover.

Conditions, search and response

According to Citrix, CVE-2026-88771 affects ADC and Gateway deployments in their default configuration; CVE-2026-88772 requires DTLS, enabled by default on VPN virtual servers until explicitly disabled. The same advisory contains six other CVEs, but Citrix only confirms active exploitation of the two RCEs investigated here. An inventory must therefore compare build, role and configuration, without treating all eight entries as a single demonstrated campaign.

To find the two bugs in an authorized audit, the procedures differ. The first requires tracking the data from a request to the log, then all consumers of this log who issue commands. The second requires a differential test of the fragmented DTLS records, the separate measurement of the logical size of the handshake and the sum of the buffers actually copied, then the examination of the control added around memcpy. watchTowr PoCs and analyzes are proofs of mechanism on the tested versions, not a guarantee of the absence of preconditions in any deployment.

Citrix recommends patched builds 14.1-73.37 or 13.1-64.23 depending on branch, as well as a compromise scan for exposed appliances. The challenge is not to confuse “the malicious payload no longer works” with “the machine never executed a command before the update”. The logs are precisely both a possible source of the attack and a source of investigation; a centrally collected copy of the logs is therefore particularly useful.

Main sources: Citrix bulletin, analysis and PoC of CVE-2026-88771, analysis and PoC of CVE-2026-88772.