Skip to content
OriginalConnect AISign inSign up free

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells

Part of the CVE-2026-88772 story · since 27 Sep

Quiet for 4 weekslast report 19 Oct29 articles13 outlets
27 Sep · SecurityOnline first25 Oct3 NovNowThis article17th of 29
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:01 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV. This article, 17th of 29.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 13:18 UTC. The Hacker News. Credential sprawl is outpacing security teams’ ability to see it. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 18:48 UTC. The Hacker News. ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools. Cites a CVE in CISA KEV.
  • Sat 10 Oct, 11:48 UTC. The Hacker News. Enterprise Software’s Hidden AI Agents Create a Security Blind Spot. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.

Unknown threat actors have been observed exploiting a newly patched flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organisations in North America and Europe. The activity, detected by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has affected government, financial services, technology, education, and legal and professional services sectors.

Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine, enabling initial root‑level access on the NSPPE component running on FreeBSD. Google notes that specially malformed or fragmented DTLS records during the pre‑auth cryptographic handshake induce heap memory boundary corruption, allowing the attacker to execute arbitrary shellcode with root privileges.

Post‑exploitation payloads include PHP web shells such as WHIPSHOT, which exfiltrates commands via Base64‑encoded headers, and a Python tunneler named SLAPSHOT to proxy traffic for internal reconnaissance and credential theft. In some cases, attackers modify httpd.conf to treat .deb and .sig files as PHP scripts, enabling persistent web shells and further compromise. The campaigns also show covert hooks disguising web shell activity as image requests and unusual mappings that trigger execution.

GreyNoise reports additional activity linked to CVE-2026-88771 and 88772 beginning 28 September 2026, signalling mass exploitation and botnet‑style deployment aimed at bot recruitment and access brokering. Citrix warns edge devices remain attractive targets due to internet exposure and often lacking EDR coverage.

How the story developed

All 29 articles
Quiet for 4 weekslast report 19 Oct29 articles13 outlets

29 articles from 13 outlets since 27 Sep. Quiet since 19 Oct. This was the 17th report, 3 days after the first.

Now27 Sep2468101214161820First reportSecurityOnline · 27 Sep, 18:30This article17th of 29 · day 3
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:01 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV. This article, 17th of 29.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 13:18 UTC. The Hacker News. Credential sprawl is outpacing security teams’ ability to see it. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 18:48 UTC. The Hacker News. ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools. Cites a CVE in CISA KEV.
  • Sat 10 Oct, 11:48 UTC. The Hacker News. Enterprise Software’s Hidden AI Agents Create a Security Blind Spot. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Sun 27 SepDay 05
    1. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances18:30 · SecurityOnline · First report · Known exploited CVE
    2. Citrix NetScaler Zero Days Exploited Against Unpatched Systems18:30 · Security Affairs · Known exploited CVE
    3. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action20:47 · CISA · official · CISA alert · Known exploited CVE
    Show 2 more from 27 Sep
    1. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days20:47 · CISA · official · Known exploited CVE
    2. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw23:01 · CISA · official · Known exploited CVE
  2. Mon 28 SepDay 18
    1. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SecurityWeek · Known exploited CVE
    2. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SOCRadar · Known exploited CVE
    3. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now08:35 · Infosecurity · Known exploited CVE
    Show 5 more from 28 Sep
    1. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws09:47 · Security Affairs · Known exploited CVE
    2. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks12:07 · Rapid7 · Known exploited CVE
    3. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws13:21 · NCSC · official · Known exploited CVE
    4. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Known exploited CVE
    5. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed15:30 · Unit 42 · Known exploited CVE
  3. Tue 29 SepDay 21
    1. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated08:00 · SecurityOnline · Known exploited CVE
  4. Wed 30 SepDay 34
    1. NetScaler Flaw Exploited to Gain Root Access Before Authentication07:13 · The Hacker News · Known exploited CVE
    2. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks08:25 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells10:13 · The Hacker News · Known exploited CVE · This article, 17th of 29
    4. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells13:16 · SecurityWeek · Known exploited CVE
  5. Thu 1 OctDay 44
    1. Active NetScaler Zero Days Expose Devices to Remote Code Execution02:14 · SecurityOnline · Known exploited CVE
    2. Attackers Exploit Critical NetScaler Flaw to Steal Configurations04:38 · The Hacker News · Known exploited CVE
    3. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords10:28 · SecurityOnline · Known exploited CVE
    4. Citrix NetScaler Zero Days Exploited Against 50,000 Devices12:31 · DataBreaches · Known exploited CVE
  6. Fri 2 OctDay 52
    1. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks17:05 · Dark Reading · Known exploited CVE
    2. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending22:22 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Mon 5 OctDay 82
    1. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes05:53 · SecurityWeek · Picked up again · Known exploited CVE
    2. Credential sprawl is outpacing security teams’ ability to see it13:18 · The Hacker News · Known exploited CVE

  8. Quiet for 3 days

    Thu 8 OctDay 111
    1. ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools18:48 · The Hacker News · Picked up again · Known exploited CVE

  9. Quiet for 2 days

    Sat 10 OctDay 131
    1. Enterprise Software’s Hidden AI Agents Create a Security Blind Spot11:48 · The Hacker News · Known exploited CVE

  10. Quiet for 9 days

    Mon 19 OctDay 221
    1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching13:24 · Cloudflare · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated