CVE-2026-107406: Citrix NetScaler Unauthenticated RCE — Emergency Patching, Detection, and Hardening Guide

---
title: NetScaler Core Process Spawning Shell or Script Interpreter
id: a1f4c9e2-7b3d-4e8a-9c61-2d5f7a0b3e19
status: experimental
description: Detects NetScaler core daemons (nshttpd, nsppe, nsaggregatord) spawning shells or script interpreters, a strong post-exploitation indicator for unauthenticated RCE such as CVE-2026-107406.
references:
  - https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/nshttpd'
      - '/nsppe'
      - '/nsaggregatord'
      - '/nsconfigd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python2'
      - '/python3'
      - '/perl'
      - '/php'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare vendor support scripts executed during guided troubleshooting; validate any hit against an active Citrix support case
level: critical
---
title: Web Shell File Creation in NetScaler Web Directories
id: c7e2b1a4-3f6d-4a9b-8e52-1c0d6f4a8b27
status: experimental
description: Detects creation of script files in NetScaler web-served directories, consistent with web shell deployment following exploitation of a pre-auth RCE such as CVE-2026-107406.
references:
  - https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/27
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/netscaler/portal/'
      - '/var/vpn/'
      - '/netscaler/ns_gui/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.pl'
      - '.py'
      - '.sh'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate custom portal theme development; reconcile hits against change tickets for portal customization
level: high
---
title: NetScaler Packet Engine Crash Loop (DoS Indicator)
id: e9d3a6f1-5c28-4b7d-a143-8f2e0b9c4d36
status: experimental
description: Detects repeated nsppe crashes or core dumps in NetScaler syslog, indicating potential denial-of-service exploitation of CVE-2026-107406 or instability from failed exploit attempts.
references:
  - https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/01/27
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: syslog
  product: linux
detection:
  selection:
    - 'nsppe'
    - 'core dump'
    - 'segmentation fault'
    - 'NSPPE'
    - 'HA heartbeats lost'
  condition: selection
falsepositives:
  - Hardware faults and genuine software defects; a single event is ambiguous — alert on repetition or correlation with inbound scanning
level: medium

// Hunt 1: NetScaler syslog evidence of crash/DoS or shell artifacts via Syslog/CEF ingestion
// Requires NetScaler syslog forwarded to Sentinel (configure under System > Auditing > Syslog)
union Syslog, CommonSecurityLog
| where TimeGenerated > ago(7d)
| where Computer has_any ("netscaler", "ns", "adc") or Facility has "local0"
| where SyslogMessage has_any ("nsppe", "core dump", "segmentation fault", "HA heartbeats lost",
                               "/netscaler/portal/", "/var/vpn/", ".php", "cmd.php", "shell")
   or Message has_any ("nsppe", "core dump", "/netscaler/portal/", "/var/vpn/")
| project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage, Message
| order by TimeGenerated desc;

// Hunt 2: Inbound requests with exploit-shaped characteristics hitting NetScaler VIPs
// Pivot off your perimeter/WAF/load balancer logs that front or observe NetScaler traffic
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has_any ("NetScaler", "ADC") or DestinationHostName has "vpn"
| extend UriLen = strlen(RequestURL)
| where UriLen > 800
   or RequestURL has_any ("/../", "%2e", "%00", "${", "cmd=", "eval(", "base64")
   or RequestMethod in ("TRACE", "TRACK", "PUT", "DELETE")
| summarize Requests = count(), DistinctURIs = dcount(RequestURL)
  by SourceIP, SourceCountry, DestinationIP, bin(TimeGenerated, 1h)
| where Requests > 50 or DistinctURIs > 20
| order by Requests desc;

// Hunt 3: Outbound connections FROM NetScaler appliances to rare external destinations
// A gateway appliance should initiate almost no internet-bound sessions; any are suspicious
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has "NetScaler" and SourceIP in (dynamic(["<NETSCALER_NSIP>", "<NETSCALER_SNIP>"]))
| where Direction == "Outbound" or isnotempty(DestinationIP)
| where ipv4_is_private(DestinationIP) == false
| summarize Connections = count(), Ports = make_set(DestinationPort)
  by SourceIP, DestinationIP, DestinationPort, bin(TimeGenerated, 1d)
| order by Connections desc;

-- Artifact: SecurityArsenal.NetScaler.CompromiseAssessment
-- Hunt for post-exploitation artifacts on a NetScaler appliance (FreeBSD-based)
-- or any FreeBSD/Linux edge device: suspicious processes and web shell files.

-- 1) Processes spawned from NetScaler daemons running shells/interpreters
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(sh|bash|python|perl|php|curl|wget|ncat?)\s'
   OR Exe =~ '/(tmp|var/tmp|dev/shm)/'

-- 2) Script files recently written into web-served directories (web shell triage)
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/netscaler/portal/**/*.php',
                 '/netscaler/portal/**/*.jsp',
                 '/var/vpn/**/*.php',
                 '/netscaler/ns_gui/**/*.php',
                 '/var/tmp/*.php',
                 '/tmp/*.sh'])
WHERE Mtime > now() - 1209600  -- last 14 days, in seconds
ORDER BY Mtime DESC

#!/bin/bash
# NetScaler compromise assessment + patch verification helper
# Run on the NetScaler shell (drop from CLI: 'shell'). Requires root on the appliance.
# 1) Verify build, 2) sweep for web shells / tampering, 3) review crashes.

echo "=== [1] Current NetScaler build ==="
nsversion 2>/dev/null || cat /flash/nsconfig/.version 2>/dev/null
# ACTION: Compare this build against the FIXED builds listed in the Citrix
# Security Bulletin for CVE-2026-107406 at https://support.citrix.com
# (search the bulletin ID/CVE). If you are below the fixed build -> patch NOW.

echo "=== [2] Script files modified in web-served dirs (last 30 days) ==="
find /netscaler/portal /var/vpn /netscaler/ns_gui \
  -type f \( -name '*.php' -o -name '*.jsp' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' \) \
  -mtime -30 -ls 2>/dev/null

echo "=== [3] Unexpected files in tmp locations ==="
ls -la /tmp /var/tmp 2>/dev/null | grep -Ev '^(total|d)' | grep -E '\.(php|sh|py|pl|elf)|^.*[0-9]{6,}'

echo "=== [4] Recent core dumps / crashes (DoS or failed exploit) ==="
ls -la /var/core/ 2>/dev/null
grep -iE 'nsppe|core dump|segfault|heartbeats lost' /var/log/ns.log 2>/dev/null | tail -50

echo "=== [5] Persistence checks: cron, rc scripts, authorized keys ==="
crontab -l 2>/dev/null; cat /etc/crontab 2>/dev/null
ls -la /nsconfig/rc.netscaler /flash/nsconfig/rc.local 2>/dev/null
find / -name authorized_keys -mtime -60 2>/dev/null

echo "=== [6] Outbound connections from the appliance (should be near-zero) ==="
netstat -an -p tcp 2>/dev/null | grep ESTABLISHED | grep -vE '127\.0\.0\.1|::1'

echo "=== [7] Config integrity: unsaved/unexpected changes ==="
diff /nsconfig/ns.conf /flash/nsconfig/ns.conf 2>/dev/null | head -40
echo "Review any new vservers, rewrite/responder policies, or 'add ns acl' entries manually."

echo "DONE. If [2]-[5] show unexpected hits, isolate the appliance and open an IR case BEFORE patching (preserve /var/log and /var/core)."