---
title: Hunt: NetScaler CVE-2026-88771 log-poisoning chain (INDEX: Base64 User-Agents, forged 'pitboss PPE' logins, Nx_7508 web shells, /var/kw2s11) | ctxsec
url: https://ctxsec.com/items/hunt-netscaler-88771-log-poisoning
description: ""
status: "exploited (CISA KEV since Sep 27; Zscaler ThreatLabz analysis)"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-netscaler-88771-log-poisoning.md)

exploited (CISA KEV since Sep 27; Zscaler ThreatLabz analysis)

2026-10-16

### Hunt: NetScaler CVE-2026-88771 log-poisoning chain (INDEX: Base64 User-Agents, forged 'pitboss PPE' logins, Nx_7508 web shells, /var/kw2s11)

Zscaler ThreatLabz (Oct 16) describes how attackers exploit CVE-2026-88771, the unauthenticated NetScaler ADC/Gateway command-execution bug that has been on KEV since Sep 27. Stage 1 sends GETs to /logon/LogonPoint/tmindex.html, /logon/LogonPoint/index.html, /vpn/index.html and /logon/tmindex.html with a User-Agent of `INDEX:` followed by Base64, which parks the payload in the HTTP access log. Stage 2 POSTs to /nf/auth/doAuthentication.do or /cgi/login with a login value that fakes a 'pitboss PPE missed too many heartbeats' or 'PPE unexpectedly died' record plus shell commands, often using `${IFS}` for spaces. That lands in /var/log/ns.log. The built-in /netscaler/ns_monuploadd_err.pl later processes the record without escaping it and runs the command. What to look for: `INDEX:` User-Agents in access logs; 'pitboss PPE' strings in auth or system logs; Nx_7508 .html/.php/.pl files under /var/vpn/bookmark, /var/vpn/theme, /netscaler/ns_gui/vpn, /var/netscaler/gui/vpn, /var/netscaler/logon/LogonPoint and /var/netscaler/gui/admin_ui/apex; `php_engine on` or an added `AddHandler cgi-script .pl` in /etc/httpd.conf; and a FreeBSD implant at /var/kw2s11 fetched from 209.141.43[.]95. ThreatLabz saw at least 26 source IPs fire the chain within about 6 to 7 minutes and lists 28 IPs. The download server overlaps with Magento/Adobe Commerce StyleSmuggler (CVE-2026-75650) activity, which Zscaler says is an investigative lead, not attribution. Capture a snapshot, syslog, the tech-support bundle and core dumps before you upgrade, because updating can destroy evidence. Fixed builds start at 14.1-73.46 and 13.1-64.29.

Sources: [Zscaler ThreatLabz (Oct 16)](https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Citrix bulletin CTX697096](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096)