# Citrix NetScaler Zero-Day Still Planting Web Shells on US VPN Gateways

- URL: https://usa-24.com/cve-2026-88771-netscaler-zero-day-exploit/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-23T08:49:53.374Z
- Updated: 2026-10-23T08:49:53.382Z
- Topics: Citrix NetScaler, Zero-Day Exploits, VPN Security, Web Shells, Patch Management

> Citrix's NetScaler zero-day CVE-2026-88771 was disclosed September 27 and is still being used to plant web shells and FreeBSD malware on unpatched US VPN and gateway appliances.

## Key takeaways

- Citrix disclosed CVE-2026-88771 and CVE-2026-88772 on September 27, 2026, and confirmed both were already exploited in the wild.
- CVE-2026-88771 is an unauthenticated command-injection flaw that works in default configurations and scores 9.5 under CVSS v4.0.
- Fixed releases are 14.1-73.37 and later and 13.1-64.23 and later, with separate FIPS builds listed by Citrix.
- Rapid7 found an early October compromise in which the attacker gained root, installed PHP web shells and scouted Active Directory and VMware vCenter.
- Patching alone may leave a backdoor in place, so hunt for web shells and setuid changes and rotate keys on any appliance that was exposed.

Attackers are still breaking into internet-facing Citrix NetScaler appliances with a zero-day that Citrix disclosed nearly four weeks ago. New reporting from October 23 shows the activity has moved well past a proof of concept. Intruders are planting web shells and a FreeBSD implant, and in one confirmed case they gained root, built a tunnel into the internal network and went looking for directory and virtualization servers. If your company runs NetScaler as a VPN or gateway, CVE-2026-88771 is still a live problem.

Citrix disclosed CVE-2026-88771 and a companion flaw, CVE-2026-88772, on September 27, 2026, in a bulletin covering eight NetScaler ADC and Gateway vulnerabilities. The company confirmed both critical flaws were already exploited in the wild. The Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalog the same day, which requires federal civilian agencies to patch. [Rapid7's zero-day analysis](https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/) lays out the timeline from there.

## What CVE-2026-88771 lets an attacker do

CVE-2026-88771 is an unauthenticated command-injection flaw, so an attacker can run commands on the appliance without logging in. It affects default configurations and needs no optional feature, according to [GBHackers](https://gbhackers.com/citrix-netscaler-rce-vulnerability/) and Rapid7. CVE-2026-88772 is a memory overflow that requires DTLS, which [Bitsight](https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-88771-cve-2026-88772-citrix-netscaler-flaws-under-exploitation) says is enabled by default for VPN virtual servers.

Citrix and the National Vulnerability Database both score the pair at 9.5 under CVSS v4.0. A separate analysis from [Sn1per](https://sn1persecurity.com/wordpress/cve-2026-88771-citrix-netscaler-preauth-rce-detection-with-sn1per/) cites NVD's CVSS 3.1 score of 9.8 for CVE-2026-88771, so the number you see depends on which version your tools use. Bitsight assigns both flaws an internal exploit-likelihood score of 10.0 out of 10. The disagreement changes little about urgency, since both versions rank the flaws as critical, but it can cause confusion in scanner reports and ticket queues.

Edge exposure is what makes this dangerous. NetScaler sits where many networks meet the internet, handling remote access and application traffic. A pre-authentication flaw there gives an attacker a strong foothold, and the device already sits on the path to internal systems.

## Which NetScaler builds are fixed

Citrix's fixed releases for CVE-2026-88771 are:

- 14.1-73.37 and later
- 13.1-64.23 and later
- FIPS builds: 14.1-73.37 FIPS and later, and 13.1.37.279

Any appliance on an earlier build is exposed. Check the build string on every node, including secondary and high-availability units, because a node you forget can stay vulnerable after the primary is fixed.

Some administrators reportedly took appliances offline after researchers warned of unpatched exploitation, before Citrix's bulletin, according to Sn1per. Taking a device offline stops new traffic, but it does not tell you whether an attacker already got in. That is why the patch is the first step, not the last.

## How attackers get in and what they plant

Zscaler ThreatLabz reports that attackers poison appliance logs to trigger command execution, plant web shells and attempt to deploy a Rust-based FreeBSD x64 implant. [Zscaler's writeup](https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability) describes that chain in detail. A compiled implant is a step beyond a web shell, and it can outlast a simple script removal.

Rapid7 investigated a confirmed compromise in early October of a NetScaler ADC running an affected 14.1 build. The attacker gained root, set up persistence, installed PHP web shells, and built command-and-control and internal tunneling. The intruder then scouted Active Directory, LDAP and VMware vCenter, and exfiltrated configuration and key material. [Rapid7's intrusion analysis](https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/) shows how far the attacker's reach extended past the appliance itself.

Rapid7 first logged exploitation attempts on September 20, 2026, at 14:28:43 UTC, and said it had identified two compromised organizations at the time of writing. Separately, Unit 42 reportedly tracked a DTLS exploitation campaign from September 4 to 24 that dropped web shells from infrastructure that changed daily, according to [Hard2bit's analysis](https://hard2bit.com/en/blog/netscaler-cve-2026-88771-88772-patch-does-not-remove-web-shell/). Rapid7 says its case overlaps with public reporting on a campaign tracked as WHIPSHOT/SLAPSHOT, though attribution is still open.

Rapid7's intrusion report carries a title that names CVE-2026-88779, a number USA 24 could not match to Citrix's bulletin. Treat that number as unconfirmed until Citrix or Rapid7 clarifies it.

## Why patching may not end a breach

This is the part administrators often miss. Hard2bit's analysis says an attacker can set the setuid bit on the shell and scrub logs, so a patched appliance can still hold a backdoor. The same analysis warns that an appliance upgraded while keeping the same keys remains exposed. Patching closes the door the attacker used, but it does not remove a shell that is already planted or make stolen keys safe again.

The pattern is familiar. USA 24 has covered an [Arista VeloCloud Orchestrator zero-day under active attack](https://usa-24.com/arista-velocloud-zero-day-exploited/) and [Fortinet's urgent FortiOS patches that shipped before the flaws were named](https://usa-24.com/fortinet-emergency-patch-fortios/). In each case the device is trusted, the attacker is outside, and the gap between disclosure and exploitation determines how much damage follows. Patch timing matters, but so does what you check after you patch.

## How to tell if your NetScaler is compromised

Work through these steps in order on every internet-facing NetScaler:

1. Confirm the build. Compare each appliance against Citrix's fixed releases and patch to 14.1-73.37 or later, or 13.1-64.23 or later. Use the FIPS builds where your environment requires them.
2. Hunt for compromise, not just patch status. Look for web shells, unexpected PHP or Perl CGI files, and setuid changes on system shells. The Hard2bit analysis and the Sn1per detection guide both point to these checks.
3. Assume a breach if you find any of those, or if the appliance was exposed while unpatched. Rotate credentials, TLS keys, and any keys stored in the configuration directory, because an archive of those files may have been taken.
4. Check your DNS and proxy logs for pylrk.cc, a command-and-control domain reported in a third-party write-up at [PitScaler](https://pitscaler.com/). Citrix has not published that domain, so verify it internally before you block it.

## What to watch next

Attribution is still open, and the count of affected organizations is not final. Published indicators reflect activity up to about September 30, and Rapid7 and Unit 42 are still updating their reports. Researchers also say the persistence methods described so far may not be the only ones. A clean scan today does not prove a clean appliance next month.

Two more threads need attention. Reporting describes a second flaw, CVE-2026-107406, that affects SAML service-provider configurations, but USA 24 has not verified its details. Sources also differ on which CVSS version to cite, which matters for teams whose prioritization tools rely on NVD's v3.1 score.

Watch for updates to Citrix's bulletin, changes to the CISA catalog entries, and the next revisions from Rapid7 and Unit 42. If the SAML flaw is confirmed, the campaign could reach well beyond the DTLS and command-injection paths described so far.

## Frequently asked questions

### How do I know if my Citrix NetScaler is affected by CVE-2026-88771?

Check the build string on every NetScaler ADC and Gateway appliance and compare it with Citrix's fixed releases: 14.1-73.37 or later, or 13.1-64.23 or later, with FIPS builds listed separately. Any appliance on an older build is exposed. Then hunt for web shells, unexpected PHP or Perl CGI files, and setuid changes, because a patch alone does not remove an existing backdoor.

### Is patching enough to fix a CVE-2026-88771 compromise?

No. Hard2bit's analysis says an attacker can set the setuid bit on the shell and scrub logs, leaving a backdoor on a patched appliance. Upgrading while keeping the same keys also leaves the appliance exposed. After any suspected compromise, rotate credentials, TLS keys and keys stored in the configuration directory.

### When did Citrix disclose the NetScaler zero-day and when was it first exploited?

Citrix disclosed CVE-2026-88771 and CVE-2026-88772 on September 27, 2026, and CISA added both to its Known Exploited Vulnerabilities catalog that day. Rapid7 first logged exploitation attempts on September 20, 2026, at 14:28:43 UTC. Published indicators reflect activity up to about September 30, so newer intrusions may not appear in current reports.

### What CVSS score applies to CVE-2026-88771?

Citrix and NVD score it 9.5 under CVSS v4.0, but one analysis cites NVD's CVSS 3.1 score of 9.8. Either score places the flaw in the critical range. Use the version your scanner reports consistently so your prioritization stays coherent.

## Sources

1. [Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware](https://gbhackers.com/citrix-netscaler-rce-vulnerability/)
2. [NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779](https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/)
3. [Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772](https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/)
4. [CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability](https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability)
5. [CVE-2026-88771, CVE-2026-88772: NetScaler Active Exploitation](https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-88771-cve-2026-88772-citrix-netscaler-flaws-under-exploitation)
6. [NetScaler CVE-2026-88771: patching leaves the web shell](https://hard2bit.com/en/blog/netscaler-cve-2026-88771-88772-patch-does-not-remove-web-shell/)
7. [CVE-2026-88771 and CVE-2026-88772: NetScaler RCE](https://sn1persecurity.com/wordpress/cve-2026-88771-citrix-netscaler-preauth-rce-detection-with-sn1per/)
8. [Citrix NetScaler Zero-Day: CVE-2026-88771 & CVE-2026-88772](https://pitscaler.com/)