{"id":2101,"date":"2026-09-30T15:02:14","date_gmt":"2026-09-30T09:32:14","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2101"},"modified":"2026-10-05T09:44:56","modified_gmt":"2026-10-05T04:14:56","slug":"citrix-netscaler-cve-2026-88772","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/citrix-netscaler-cve-2026-88772\/","title":{"rendered":"Citrix NetScaler CVE-2026-88772 Exploitation: Web Shells, Root Access and Internal Tunneling"},"content":{"rendered":"

Citrix NetScaler CVE-2026-88772 has moved beyond a critical vulnerability disclosure into a documented post-exploitation campaign.<\/p>\n

Mandiant and Google Threat Intelligence Group (GTIG) identified active exploitation affecting NetScaler ADC and NetScaler Gateway appliances. Evidence suggests the campaign has operated since at least early September 2026.<\/p>\n

Affected organizations were located in North America and Europe. They spanned government, financial services, technology, education, legal and professional services.<\/p>\n

The attack chain is particularly significant because exploitation occurs before authentication and can provide root-level execution on the NetScaler appliance. In observed intrusions, attackers subsequently established persistence by modifying web server configurations, deploying web shells, and altering \/bin\/sh<\/code> permissions. Mandiant also observed attackers using compromised appliances to proxy traffic into internal networks.<\/p>\n

CVE-2026-88772 is a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway that can cause remote code execution or denial of service when DTLS<\/a> is enabled. Citrix assigned the vulnerability a CVSS v4.0 score of 9.5 and confirmed exploitation in the wild.<\/p>\n

Citrix NetScaler CVE-2026-88772 at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Vulnerability Attribute<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-88772<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected products<\/span><\/b>\u00a0<\/span><\/td>\nNetScaler ADC and NetScaler Gateway<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability type<\/span><\/b>\u00a0<\/span><\/td>\nMemory overflow \/ CWE-119<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span><\/b>\u00a0<\/span><\/td>\n9.5, Critical, CVSS v4.0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Attack prerequisite<\/span><\/b>\u00a0<\/span><\/td>\nDTLS enabled; DTLS is enabled by default on VPN vServers<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Potential impact<\/span><\/b>\u00a0<\/span><\/td>\nRemote code execution or denial of service<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Observed execution context<\/span><\/b>\u00a0<\/span><\/td>\nRoot-level access in documented exploitation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation status<\/span><\/b>\u00a0<\/span><\/td>\nConfirmed active exploitation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed NetScaler ADC\/Gateway builds<\/span><\/b>\u00a0<\/span><\/td>\n14.1-73.37 and 13.1-64.23 or later<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed FIPS\/NDcPP builds<\/span><\/b>\u00a0<\/span><\/td>\n14.1-73.37 FIPS and 13.1-37.279 FIPS\/NDcPP or later<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span><\/b>\u00a0<\/span><\/td>\nAdded September 27, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CVE-2026-88772 requires DTLS to be enabled, according to Citrix. NetScaler Gateway VPN virtual servers enable DTLS by default unless administrators explicitly disable it.<\/p>\n

How Malformed DTLS Traffic Reaches Root on NetScaler<\/h2>\n

The available evidence provides a clearer picture of how Citrix NetScaler CVE-2026-88772 reaches code execution.<\/p>\n

During the pre-authentication cryptographic handshake, the NetScaler Packet Processing Engine, or NSPPE, parses incoming DTLS record structures.<\/p>\n

GTIG does not possess the exploit code. However, its analysis of frontline telemetry suggests specially malformed or fragmented DTLS record headers can trigger heap memory boundary corruption inside NSPPE. The corruption can divert execution to attacker-supplied shellcode with root-level privileges on the underlying FreeBSD platform.<\/p>\n

Successful exploitation attempts also produced observable artifacts. These included DTLS handshake failures and messages showing unexpected NSPPE process termination.<\/p>\n

This distinction matters. Citrix describes the vulnerability broadly as a memory overflow leading to RCE or denial of service. Mandiant and GTIG’s incident-response evidence<\/a> provides the more detailed explanation of how exploitation appears to work in observed environments.<\/p>\n

<\/div>

How Endpoint Isolation Stops Lateral Movement During an Active Attack<\/h4>

Learn how endpoint isolation restricts network access during an active compromise.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div>\n

Attackers Turned Web Server Configuration Into Persistence<\/h2>\n

After gaining root-level execution, attackers established additional persistence on the appliance.<\/p>\n

Mandiant found attackers modifying NetScaler httpd.conf<\/code> files so extensions that would not normally indicate PHP code could execute as PHP scripts.<\/p>\n

Observed examples included files masquerading as Debian packages, signature files and other web assets. Some web shells returned fake HTTP 404 Not Found responses while processing encoded attacker commands.<\/p>\n

The attackers also addressed a privilege problem created after initial exploitation.<\/p>\n

Initial exploitation executes with root privileges. However, subsequent requests handled by the web server run under an unprivileged service context. Mandiant observed attackers setting the setuid bit on \/bin\/sh<\/code> using chmod u+s \/bin\/sh<\/code>. This allowed subsequent web-shell commands to execute with elevated permissions.<\/p>\n

Attackers also restarted the web server or rebooted the NetScaler appliance to activate configuration changes. Organizations should investigate previously exposed appliances for persistence even after applying the security update.<\/p>\n

WHIPSHOT and SLAPSHOT Turn NetScaler Into an Internal Proxy<\/h2>\n

Mandiant identified two previously undocumented malware families in the campaign: WHIPSHOT and SLAPSHOT.<\/p>\n

WHIPSHOT is a PHP web shell disguised as a Debian package. It accepts encoded data through HTTP request headers and acts as the external transport layer for SLAPSHOT.<\/p>\n

WHIPSHOT communicates locally with SLAPSHOT through the loopback interface. It can also launch the Python payload if the tunneler is not already running.<\/p>\n

SLAPSHOT provides the TCP tunneling layer used to reach internal hosts.<\/p>\n

The Python-based tunneler can establish arbitrary TCP connections to target hosts and relay traffic through the compromised NetScaler appliance. Its command protocol supports opening connections, transmitting data, receiving data and closing sessions.<\/p>\n

More importantly, this was not only a theoretical malware capability. In at least one observed intrusion, Mandiant saw the threat actor route traffic through the proxy to conduct internal reconnaissance and credential theft.<\/p>\n

That activity changes the incident-response boundary. Defenders should not limit investigation to the compromised NetScaler appliance when evidence indicates attackers may have used it as a path toward internal systems.<\/p>\n

Patch CVE-2026-88772, Then Hunt for Existing Persistence<\/h2>\n

Citrix confirmed exploitation of both CVE-2026-88772 and CVE-2026-88771 on unmitigated NetScaler deployments. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27.<\/p>\n

For CVE-2026-88772, organizations should first determine whether DTLS is enabled. According to Citrix, the vulnerability affects NetScaler ADC or NetScaler Gateway when DTLS is enabled.\u00a0NetScaler Gateway VPN virtual servers enable DTLS by default unless administrators explicitly disable it.<\/p>\n

Citrix recommends installing the relevant fixed build:<\/p>\n