Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data

Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration data.

The activity goes beyond simple testing, with malicious scripts designed to maintain access and send stolen files to attacker infrastructure. The flaw affects NetScaler ADC and NetScaler Gateway and allows command execution before authentication.

Citrix rates it 9.5 under CVSS 4.0 and says vulnerable default deployments are exposed without any extra feature enabled. Its confirmed NetScaler zero-day exploitation prompted emergency updates on September 27, 2026.

Researchers from LevelBlue’s Threat Hunt Operations & Research team identified malicious authentication events across multiple customer environments.

Their September 30 technical report describes Python and Perl payloads supporting reverse shells, privileged accounts, web shells, and attempted configuration theft. The findings do not establish that every attempt succeeded.

Hackers Exploit Critical Citrix NetScaler Flaw

Attackers placed shell commands inside usernames, often alongside pitboss, NSPPE, and unexpectedly died. Some used whoami to test execution, while others used curl or wget to fetch more code.

Commands also copied the main configuration into a web directory or archived the configuration folder for later retrieval. One variation used command substitution and ${IFS}, which represents whitespace without literal spaces.

This gives defenders another useful search pattern: suspicious authentication fields containing crash-related text together with commands for downloading, reading, or archiving files.

The Python payload overwrites an appliance component with reverse-shell code. That code connects outward over TCP port 443, redirects input and output to the connection, and starts an interactive shell. The original script also terminates matching processes associated with the targeted component.

Web Shells and Configuration Theft

The Perl payload creates a local superuser account, archives the configuration directory, and attempts to upload the archive. It then removes the archive and deletes itself. Missing files therefore do not prove that the payload failed or that no data left the appliance.

It also changes shell permissions to 6555 and installs a PHP web shell. Changes to the HTTP server configuration enable PHP and expose the shell through addresses resembling normal CSS resources.

This echoes Google’s NetScaler web-shell findings involving disguised files, although LevelBlue does not identify its payload as the same malware.

The installed shell supports remote commands, uploads, and downloads. Together with the added administrator account, these changes give attackers several ways to keep control of the appliance after initial exploitation.

Security teams should examine authentication records, unexpected configuration access, new web-directory files, privileged account changes, and outbound traffic following suspicious login events.

LevelBlue warns that failed authentication does not mean command injection failed; investigators must check what happened afterward.

Known hashes and IP addresses help locate this activity, but attackers can change them. More lasting warning signs include shell commands in authentication data, altered appliance components, and configuration archives placed where the web server can serve them.

Carefully review network records together with file and account changes to determine whether an attempt led to a working shell or a transfer of configuration data. Administrators should follow Citrix’s official security bulletin and install an appropriate supported update.

The earlier urgent NetScaler patch guidance also stresses investigating possible compromise, rather than treating an update as proof that an appliance is clean.

The bulletin lists fixes for this flaw in 14.1-73.37 and 13.1-64.23, with corresponding FIPS and NDcPP builds. These are the minimum fixes in that advisory, not a claim that they are the latest releases. Teams should check current vendor guidance before choosing an update, especially where other NetScaler vulnerabilities also apply.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC