NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
Exploitation of internet-exposed Citrix NetScaler ADC and Gateway appliances has escalated from stealthy zero-day use to widespread scanning after watchTowr Labs published a proof of concept for CVE-2026-88771. Citrix patched eight flaws, including zero-days CVE-2026-88771 and CVE-2026-88772; GreyNoise observed an attempt on September 24, before public disclosure. Attackers seek admin access, hide unique webshells, poison logs, and exfiltrate data, including to a Hetzner server. Censys sees about 42,000 exposed hosts, fewer than 10% appear patched, and more than 100 victim organizations are being tracked.
- CVE-2026-88771 and CVE-2026-88772 were exploited as zero-days.
- A public proof of concept triggered internet-wide opportunistic scanning.
- About 42,000 NetScaler hosts are exposed and under 10% are patched.
- A researcher is tracking over 100 victims with unique webshells.
- No public proof of concept is available yet for CVE-2026-88772.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1070 Indicator RemovalT1041 Exfiltration Over C2 Channel
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | instances.httpworkbench.com | ied NSPPE , and to watch DNS for outbound lookups ending in instances.httpworkbench.com , which indicates a host in their estate has already been h |
| ipv4 | 138.199.200.90 | and the collected data is exfiltrated to a Hetzner server (138.199.200.90). His advice to organizations is to hunt for POST /nf/auth/ |
From the original article
3 min read at helpnetsecurity.com
The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread “spray and pray” exploitation, fueled by the publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771, which is remotely exploitable on unpatched devices with the default configuration.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.