Exploit / PoCcriticalExploited in the wild

Attackers exploit Citrix NetScaler RCE to deploy web shells

Original title: Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware

Cyber Security Newsby Tushar Subhra DuttaOct 23, 2026 · 07:50 UTC (7d ago)4 min read4

Part of a story covered by 2 sourcesAttackers exploit Citrix NetScaler RCE to deploy malwareMerged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

Unauthenticated CVE-2026-88771, scored 9.5, is used to poison logs, run commands, and drop a FreeBSD payload.

Citrix says unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway to run commands on unpatched internet-facing appliances. Zscaler ThreatLabz described log poisoning through the User-Agent field, later command execution, web-shell attempts, and delivery of a Rust FreeBSD binary. Citrix and Zscaler list different minimum fixed builds, and a patch alone does not show an appliance is clean.

Unconfirmed: Zscaler says shared infrastructure does not prove one group, and not every targeted appliance was shown to be compromised; it also lists later builds than Citrix's initial bulletin.

Key facts

Citrix rates CVE-2026-88771 at CVSS 4.0 9.5 and confirmed attacks.
Zscaler observed payload kw2-freebsd-x64-s11 written to /var/kw2s11.
Citrix initially listed 14.1-73.37 and 13.1-64.23; Zscaler cites later builds.
At least 26 source IPs were seen over roughly six to seven minutes.

Security assessment · AI, from the articleExploited in the wild

Impact: unauthenticated remote command execution, web shells, and malware

Product	Affected	Fixed in
Citrix NetScaler ADC	—	14.1-73.37 and 13.1-64.23, or later in those branches
Citrix NetScaler Gateway	—	14.1-73.37 and 13.1-64.23, or later in those branches

What to do

1.Install a currently supported fixed build from the Citrix security bulletin.
2.Review logs for markers, unexpected downloads, web files, and altered HTTP settings.
3.If compromise is confirmed, rotate credentials, tokens, and certificates.

Analyze CVE-2026-88771 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-88771

ATT&CK: T1190 Exploit Public-Facing Application T1505.003 Web Shell T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer

Tags: citrix netscaler rce web-shell freebsd

Vendors: Citrix
Products: NetScaler ADC NetScaler Gateway
Organizations: Zscaler

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-88771	Unauthenticated RCE in Citrix NetScaler ADC and Gateway	9.5	82%	KEVPoC ×5	Sep 27, 2026 KEV Sep 27, 2026

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
ipv4	100.38.125.66	81.10.79[.]197 IPv4 82.167.14[.]7 IPv4 95.105.74[.]172 IPv4 100.38.125[.]66 IPv4 102.213.132[.]123 IPv4 102.222.146[.]45 IPv4 103.181
ipv4	102.213.132.123	2.167.14[.]7 IPv4 95.105.74[.]172 IPv4 100.38.125[.]66 IPv4 102.213.132[.]123 IPv4 102.222.146[.]45 IPv4 103.181.212[.]245 IPv4 103.197
ipv4	102.222.146.45	5.74[.]172 IPv4 100.38.125[.]66 IPv4 102.213.132[.]123 IPv4 102.222.146[.]45 IPv4 103.181.212[.]245 IPv4 103.197.249[.]161 IPv4 103.83
ipv4	103.181.212.245	.125[.]66 IPv4 102.213.132[.]123 IPv4 102.222.146[.]45 IPv4 103.181.212[.]245 IPv4 103.197.249[.]161 IPv4 103.83.146[.]100 IPv4 111.92.
ipv4	103.197.249.161	132[.]123 IPv4 102.222.146[.]45 IPv4 103.181.212[.]245 IPv4 103.197.249[.]161 IPv4 103.83.146[.]100 IPv4 111.92.128[.]89 IPv4 114.145.4
ipv4	103.83.146.100	146[.]45 IPv4 103.181.212[.]245 IPv4 103.197.249[.]161 IPv4 103.83.146[.]100 IPv4 111.92.128[.]89 IPv4 114.145.49[.]215 IPv4 120.244.1
ipv4	111.92.128.89	212[.]245 IPv4 103.197.249[.]161 IPv4 103.83.146[.]100 IPv4 111.92.128[.]89 IPv4 114.145.49[.]215 IPv4 120.244.160[.]182 IPv4 125.62.
ipv4	114.145.49.215	7.249[.]161 IPv4 103.83.146[.]100 IPv4 111.92.128[.]89 IPv4 114.145.49[.]215 IPv4 120.244.160[.]182 IPv4 125.62.88[.]26 IPv4 130.12.18
ipv4	120.244.160.182	3.146[.]100 IPv4 111.92.128[.]89 IPv4 114.145.49[.]215 IPv4 120.244.160[.]182 IPv4 125.62.88[.]26 IPv4 130.12.182[.]7 IPv4 154.183.158[
ipv4	125.62.88.26	.128[.]89 IPv4 114.145.49[.]215 IPv4 120.244.160[.]182 IPv4 125.62.88[.]26 IPv4 130.12.182[.]7 IPv4 154.183.158[.]198 IPv4 154.241.2
ipv4	130.12.182.7	45.49[.]215 IPv4 120.244.160[.]182 IPv4 125.62.88[.]26 IPv4 130.12.182[.]7 IPv4 154.183.158[.]198 IPv4 154.241.254[.]9 IPv4 174.60.6
ipv4	154.183.158.198	.244.160[.]182 IPv4 125.62.88[.]26 IPv4 130.12.182[.]7 IPv4 154.183.158[.]198 IPv4 154.241.254[.]9 IPv4 174.60.63[.]37 IPv4 177.52.203[
ipv4	154.241.254.9	.62.88[.]26 IPv4 130.12.182[.]7 IPv4 154.183.158[.]198 IPv4 154.241.254[.]9 IPv4 174.60.63[.]37 IPv4 177.52.203[.]23 IPv4 183.63.88[.
ipv4	174.60.63.37	12.182[.]7 IPv4 154.183.158[.]198 IPv4 154.241.254[.]9 IPv4 174.60.63[.]37 IPv4 177.52.203[.]23 IPv4 183.63.88[.]227 IPv4 190.117.56
ipv4	177.52.203.23	183.158[.]198 IPv4 154.241.254[.]9 IPv4 174.60.63[.]37 IPv4 177.52.203[.]23 IPv4 183.63.88[.]227 IPv4 190.117.56[.]56 IPv4 195.62.37[
ipv4	183.63.88.227	4.241.254[.]9 IPv4 174.60.63[.]37 IPv4 177.52.203[.]23 IPv4 183.63.88[.]227 IPv4 190.117.56[.]56 IPv4 195.62.37[.]119 IPv4 207.48.184
ipv4	190.117.56.56	4.60.63[.]37 IPv4 177.52.203[.]23 IPv4 183.63.88[.]227 IPv4 190.117.56[.]56 IPv4 195.62.37[.]119 IPv4 207.48.184[.]10 Note: IP addres
ipv4	195.62.37.119	.52.203[.]23 IPv4 183.63.88[.]227 IPv4 190.117.56[.]56 IPv4 195.62.37[.]119 IPv4 207.48.184[.]10 Note: IP addresses and domains are i
ipv4	207.48.184.10	.63.88[.]227 IPv4 190.117.56[.]56 IPv4 195.62.37[.]119 IPv4 207.48.184[.]10 Note: IP addresses and domains are intentionally defanged
ipv4	45.153.212.101	cess. Indicators of compromise (IoCs):- Type Indicator IPv4 45.153.212[.]101 IPv4 46.233.40[.]20 IPv4 46.236.167[.]143 IPv4 46.33.33[.
ipv4	46.233.40.20	mpromise (IoCs):- Type Indicator IPv4 45.153.212[.]101 IPv4 46.233.40[.]20 IPv4 46.236.167[.]143 IPv4 46.33.33[.]95 IPv4 49.150.197[
ipv4	46.236.167.143	pe Indicator IPv4 45.153.212[.]101 IPv4 46.233.40[.]20 IPv4 46.236.167[.]143 IPv4 46.33.33[.]95 IPv4 49.150.197[.]119 IPv4 78.190.152[
ipv4	46.33.33.95	53.212[.]101 IPv4 46.233.40[.]20 IPv4 46.236.167[.]143 IPv4 46.33.33[.]95 IPv4 49.150.197[.]119 IPv4 78.190.152[.]64 IPv4 81.10.79[
ipv4	49.150.197.119	6.233.40[.]20 IPv4 46.236.167[.]143 IPv4 46.33.33[.]95 IPv4 49.150.197[.]119 IPv4 78.190.152[.]64 IPv4 81.10.79[.]197 IPv4 82.167.14[.
ipv4	78.190.152.64	236.167[.]143 IPv4 46.33.33[.]95 IPv4 49.150.197[.]119 IPv4 78.190.152[.]64 IPv4 81.10.79[.]197 IPv4 82.167.14[.]7 IPv4 95.105.74[.]1
ipv4	81.10.79.197	.33.33[.]95 IPv4 49.150.197[.]119 IPv4 78.190.152[.]64 IPv4 81.10.79[.]197 IPv4 82.167.14[.]7 IPv4 95.105.74[.]172 IPv4 100.38.125[.
ipv4	82.167.14.7	150.197[.]119 IPv4 78.190.152[.]64 IPv4 81.10.79[.]197 IPv4 82.167.14[.]7 IPv4 95.105.74[.]172 IPv4 100.38.125[.]66 IPv4 102.213.13
ipv4	95.105.74.172	78.190.152[.]64 IPv4 81.10.79[.]197 IPv4 82.167.14[.]7 IPv4 95.105.74[.]172 IPv4 100.38.125[.]66 IPv4 102.213.132[.]123 IPv4 102.222.

From the original article

4 min read at cybersecuritynews.com

A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware. Tracked as CVE-2026-88771, the vulnerability stems from improper input validation and can allow an unauthenticated attacker to execute commands remotely. Citrix gives it a CVSS 4.

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.