Citrix NetScaler Exploitation Analysis and Hunting Guide

In September 2026, a series of critical vulnerabilities (CVE-2026-88771, CVE-2026-88772) in Citrix NetScaler ADC and Gateway were disclosed following months of suspected targeted and opportunistic exploitation. Adversaries leverage unauthenticated command execution (T1190) by poisoning log files with crafted payloads that are later executed by root-level scripts. Successful exploitation results in the deployment of various implants including SLAPSHOT, WHIPSHOT, and the Platypus management tool to maintain long-term access.

Technical analysis reveals that attackers frequently modify Apache configurations to enable PHP execution for webshells and set the SUID bit on shell binaries for privilege escalation. Even after patching, persistence mechanisms such as cron entries and modified binaries often remain active, necessitating a comprehensive rebuild of suspected compromised instances. The situation is ongoing, with new reports suggesting configuration-dependent exploitation vectors affecting even patched systems utilizing SAML authentication.

Failure to act poses a severe risk to organizational perimeter security, potentially leading to full internal network pivoting, data exfiltration, and unauthorized lateral movement. Affected sectors include information technology, financial services, and government facilities, emphasizing the high-value nature of the targeted appliances.