Affected Systems

Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it. Attacks observed since early September 2026 targeting North America and Europe across government, financial services, education, legal, and professional services sectors.

Exploitation Status

Active exploitation confirmed in the wild since at least early September 2026. Threat actors deploying custom web shells (WHIPSHOT) and tunneling malware (SLAPSHOT). Exploits bypass authentication, grant root access, and enable lateral movement. GreyNoise observed exploitation on September 24, three days before public disclosure. Citrix released patches on September 29, 2026.

Business Impact

Attackers gain root-level access to NetScaler appliances, deploy persistent web shells disguised as legitimate files (.deb, .sig, .css), modify web server configurations to hide malicious activity, steal credentials, and pivot into internal networks via TCP tunneling. Compromised appliances serve as entry points for reconnaissance and credential theft. Organizations may face data exfiltration, network compromise, and operational disruption. Mandiant and GreyNoise confirmed multiple intrusions with sophisticated post-exploitation techniques including setuid bit manipulation on /bin/sh for privilege persistence.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Citrix security updates for CVE-2026-88772 and CVE-2026-88771 immediately to all NetScaler ADC and Gateway appliances.
  • Hunt for indicators of compromise: check for file /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, inspect /etc/httpd.conf for suspicious Alias or AliasMatch entries mapping .css, .deb, .sig, or .ico files to PHP execution, and verify /bin/sh permissions (setuid bit should not be set).
  • Block or investigate traffic from known malicious IP 149.104.78.141 and review NetScaler logs for HTTP requests to unusual file extensions (.deb, .sig files) in VPN directories or requests returning fake 404 responses.
  • Disable DTLS on NetScaler appliances if not operationally required, as CVE-2026-88772 requires DTLS to be enabled for exploitation.
  • Monitor for unexpected NSPPE (NetScaler Packet Processing Engine) crashes, web server restarts, or appliance reboots, and review authentication logs for bypassed login attempts or root-level command execution from web server processes.