Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.
In late September 2026, Mandiant and Google Threat Intelligence identified active in-the-wild exploitation of zero-day CVE-2026-88772 in Citrix NetScaler ADC and NetScaler Gateway, ongoing since at least early September. The flaw bypasses authentication and triggers unhandled termination of the NetScaler Packet Processing Engine to achieve root-level shellcode execution on the underlying FreeBSD platform. Impacted organizations span North America and Europe across government, financial services, education, legal, and professional services sectors. The actor deploys the custom WHIPSHOT PHP web shell, which disguises Base64-encoded C2 payloads in HTTP headers, and the SLAPSHOT Python tunneler for internal reconnaissance and credential theft; a second zero-day, CVE-2026-88771, is also actively exploited per vendor disclosure.
- Zero-days CVE-2026-88772 and CVE-2026-88771 actively exploited in NetScaler ADC and Gateway
- Auth bypass plus NSPPE crash yields root-level shellcode execution on FreeBSD
- WHIPSHOT web shell hides Base64 C2 in HTTP headers; persistence via httpd.conf tricks
- SLAPSHOT tunneler proxies traffic into internal networks for reconnaissance and credential theft
- Government, finance, education, legal victims in North America and Europe since early September
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1548.001 Setuid and SetgidT1090.001 Internal Proxy
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
12 min read at cloud.google.com
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances.
By Mandiant · cloud.google.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.