Attackers exploit Citrix NetScaler RCE to deploy malware
October 27: SecurityWeek says mid-September exploitation of undisclosed NetScaler flaws prompted weekend disconnect advice, then Sunday patches for CVE-2026-88771 through CVE-2026-88778.
Unauthenticated attackers are exploiting CVE-2026-88771 on internet-facing NetScaler ADC and Gateway to run commands and drop malware.
Citrix says unauthenticated attackers are exploiting CVE-2026-88771, a CVSS v4.0 9.5 remote code execution flaw in NetScaler ADC and Gateway that needs no optional features. Zscaler ThreatLabz described User-Agent log poisoning, later command execution, web-shell attempts, and delivery of a Rust FreeBSD binary. Citrix disclosed the flaw on September 27, 2026, and GBHackers reports CISA added it to the Known Exploited Vulnerabilities catalog. Cyber Security News reports Citrix and Zscaler list different minimum fixed builds, and a patch alone does not show an appliance is clean. SecurityWeek says the September response covered CVE-2026-88771 through CVE-2026-88778 after resellers urged admins to restrict or disconnect edge systems.
- ThreatLabz saw payload kw2-freebsd-x64-s11 written to /var/kw2s11.
- At least 26 source IPs were seen over roughly six to seven minutes.
- GBHackers lists fixes including 14.1-73.37 and 13.1-64.23 and later.
- FIPS and NDcPP fixes include 14.1-73.37 FIPS and later and 13.1.37.279.
- Payload hosting overlapped CVE-2026-75650 infrastructure; shared operators are unconfirmed.
Timeline
dated events in the reporting · oldest first- Sep 26, 2026Resellers urged restricting or disconnecting internet-facing NetScaler systems. · SecurityWeek
- Sep 27, 2026Citrix disclosed CVE-2026-88771 and published fixed builds. · GBHackers
What each outlet adds
beyond the shared facts- Cyber Security NewsDisputed minimum fixed builds, payload path, and 26 source IPs.
- GBHackersCISA KEV listing, FIPS and NDcPP builds, and infrastructure overlap.
- SecurityWeekMid-September start, disconnect advice, and patched CVE range through 88778.
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Coverage
oldest first · one row per article · UTC- · 7d ago
Cyber Security NewsFirst report
Attackers exploit Citrix NetScaler RCE to deploy web shells
Unauthenticated CVE-2026-88771, scored 9.5, is used to poison logs, run commands, and drop a FreeBSD payload.
- · 7d ago
GBHackers
Attackers exploit Citrix NetScaler RCE CVE-2026-88771
Unauthenticated attackers poison logs, plant web shells and try to run a FreeBSD implant; CISA listed the flaw.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88771 | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88778 | Predictable-value flaw in Citrix NetScaler ADC and Gateway | 8.8 | — |