Metasploit adds exploit module for Citrix NetScaler command injection flaw
Rapid7's weekly wrapup lists a new module for the unauthenticated NetScaler bug that Citrix said was exploited before disclosure, alongside modules for Cisco Secure Email Gateway and GitLab.
Rapid7's Metasploit wrapup for the week, published on 6 November, lists a new exploit module for the Citrix NetScaler unauthenticated command injection bug tracked as CVE-2026-88771. The module's description says the flaw was "reported as being exploited in the wild by the vendor prior to public disclosure." That's the vendor's claim as Rapid7 relays it; the wrapup gives no figures on how many appliances were hit.
The module credits CERT-EU, Scyrix LLC, sfewer-r7 and watchTowr, and sits at freebsd/http/citrix_netscaler_cve_2026_88771. The same entry carries a CVE reference of CVE-2026-88773, which doesn't match the module name. Rapid7's post doesn't explain the discrepancy, and we haven't seen a write-up that does.
The release also adds an unauthenticated RCE module for Cisco Secure Email Gateway, which Rapid7 says it believes maps to CVE-2026-76443 because the Cisco advisories are vague, and a GitLab CI/CD regex integer overflow module for CVE-2026-97229 that needs credentials with write access to a public project.
For defenders, the NetScaler module is the one to act on. If you run ADC or Gateway, check your build against Citrix's bulletin and treat internet-facing instances as suspect until you've looked. Metasploit modules lower the effort for anyone who wants to try; they don't change who's already been in.
CVE references
Sources
- Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much morePrimarywww.rapid7.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning