Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.
Attackers exploited two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, sometimes called PitScaler, to gain root on ADC and Gateway appliances and move into internal networks. CVE-2026-88771 is unauthenticated remote code execution on all deployments, while CVE-2026-88772 is a DTLS memory-overflow flaw that can yield code execution or denial of service. Mandiant says activity began by early September against organizations in North America and Europe across government, financial services, education, legal, and professional services. Intruders installed PHP web shells, including new families WHIPSHOT and SLAPSHOT, rewrote httpd.conf so benign-looking files executed PHP, and set the setuid bit on /bin/sh.
- Citrix confirmed both flaws were exploited on unpatched NetScaler ADC and Gateway systems.
- CVE-2026-88771 is unauthenticated RCE; CVE-2026-88772 is a DTLS memory overflow.
- GreyNoise logged attempts from 149.104.78.141 on September 24, before disclosure.
- Attackers planted PHP web shells and set the setuid bit on /bin/sh.
- WHIPSHOT and SLAPSHOT tunnel traffic so attackers can reach internal hosts and steal credentials.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1548.001 Setuid and SetgidT1572 Protocol TunnelingT1036.008 Masquerade File Type
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 149.104.78.141 | -88772. According to GreyNoise , the attack originated from 149.104.78.141, and its platform detected it before CVE detections were av |
From the original article
5 min read at bleepingcomputer.com
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.