CyberNew CyberNew
Vulnerabilities & CVEs BleepingComputer 2 weeks ago

Hackers exploit Citrix NetScaler zero-day to deploy web shells

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Data & Identity Stores
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. Mandiant says the attacks began in at least early September and are believed to have impacted organizations in North America and Europe across the government, financial services,..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Citrix

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.

Mandiant says the attacks began in at least early September and are believed to have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.

The campaign first came to light over the weekend, when Citrix administrators began reporting that IT suppliers, security teams, CERTs, and national cybersecurity agencies privately warned organizations about two unpatched NetScaler zero-days and, in some cases, advised them to shut down affected appliances.

Cybersecurity firm watchTowr later said it had verified reports that two NetScaler remote code execution zero-days were being exploited in the wild and that Citrix was preparing patches.

Citrix ultimately disclosed the flaws on Sunday as CVE-2026-88771 and CVE-2026-88772, with some researchers dubbing the vulnerabilities "PitScaler."

Citrix confirmed that both had been exploited on unmitigated NetScaler deployments and releasing security updates to address them.

CVE-2026-88771 is an unauthenticated remote code execution flaw affecting all NetScaler ADC and Gateway deployments, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service when DTLS is enabled.

Exploited in zero-day attacks

GreyNoise observed a threat actor attempting to exploit a Citrix NetScaler Gateway on September 24, three days before Citrix publicly disclosed CVE-2026-88771 and CVE-2026-88772.

According to GreyNoise, the attack originated from 149.104.78.141, and its platform detected it before CVE detections were available.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →