Attackers have been exploiting two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, designated CVE-2026-88771 and CVE-2026-88772, to gain root access, deploy web shells, and infiltrate internal networks. Citrix confirmed the active exploitation of both flaws and released security updates to address them.
The campaign reportedly began in early September, impacting organizations in North America and Europe across various sectors including government, financial services, education, legal, and professional services. Cybersecurity firms privately alerted organizations to the unpatched vulnerabilities and, in some cases, advised them to shut down affected appliances before Citrix publicly disclosed the issues.
CVE-2026-88771 is an unauthenticated remote code execution flaw affecting all NetScaler ADC and Gateway deployments. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service when DTLS is enabled.
Observations of exploitation attempts date back to September 24, three days prior to Citrix's public disclosure. One observed attack originated from IP address 149.104.78.141 and involved attempts to modify `/bin/sh` to provide a root shell and install a password-protected PHP web shell at `/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver`. The attackers also tried to modify `/etc/httpd.conf` to redirect requests for seemingly innocuous CSS files, such as `receiver.min.css`, to open the hidden PHP web shell.
Further analysis indicates that exploits for CVE-2026-88772 bypass authentication and cause the NetScaler Packet Processing Engine (NSPPE) to terminate unexpectedly, granting attackers root-level access. This is believed to occur through specially malformed or fragmented record headers that induce heap memory boundary corruption within the packet engine, leading to arbitrary shellcode execution with root privileges on the underlying FreeBSD platform.
Post-exploitation activities include the installation of PHP web shells and modifications to the NetScaler web server configuration. Attackers configured the web server to process non-executable file extensions as PHP, allowing web shells to operate from directories typically housing NetScaler client software. In some instances, `.deb` files were configured to execute as PHP, while in others, `.sig` files were used, and requests for `.ico` images under `/vpn/media/` were mapped to malicious PHP files. This allowed malicious web shell requests to appear as legitimate image or CSS file requests while executing commands via PHP functions like `shell_exec()` or `eval()`. Some web shells returned fake HTTP 404 responses to further mask their activity.
Threat actors deployed two previously undocumented malware families: WHIPSHOT and SLAPSHOT. WHIPSHOT is a PHP web shell disguised as a Debian package and stored in the NetScaler VPN scripts directory. It functions as an HTTP proxy for SLAPSHOT, extracting Base64-encoded data from HTTP request headers and forwarding it to the tunneling malware. WHIPSHOT can also check for SLAPSHOT's presence and launch embedded Python payloads.
SLAPSHOT is a Python-based TCP tunneling tool designed to bridge the compromised NetScaler appliance with internal devices, facilitating lateral movement within the network. It receives commands from WHIPSHOT, opens connections to internal hosts, transmits and receives data, and closes sessions. This proxy functionality was used in at least one observed intrusion for manual reconnaissance and credential theft. SLAPSHOT can also self-terminate after periods of inactivity, complicating detection.
While initial exploitation grants root privileges, commands executed by the web shells would typically run under a lower-privileged account associated with the NetScaler web servers. To maintain persistent root access, attackers modified permissions on `/bin/sh` by asserting the setuid bit, ensuring that commands run with elevated privileges. Attackers also rebooted NetScaler appliances or restarted the web server to apply configuration changes.
NetScaler ADC and Gateway appliances are attractive targets due to their internet exposure and their placement at the edge of internal networks, often lacking the protection of Endpoint Detection and Response (EDR) software.
Organizations are strongly advised to install the latest Citrix security updates to address both vulnerabilities. For those unable to patch immediately, disabling DTLS where operationally feasible and blocking inbound UDP/443 upstream when DTLS is not required can mitigate CVE-2026-88772. However, these mitigations do not protect against CVE-2026-88771.
Defenders should also inspect NetScaler appliances for signs of compromise, including unauthorized PHP handlers or aliases in `httpd.conf`, suspicious `.deb` or `.sig` files containing PHP code, unusual HTTP 404 responses, unexpected NSPPE crashes, and the presence of `/tmp/.uxdport` or `/tmp/.uxdlock` files associated with SLAPSHOT. Checks should also be performed for modifications to `/bin/sh` to run with setuid root permissions and for suspicious Python processes launched with `nohup` or containing Base64-encoded payloads.
