Attackers Exploit Citrix NetScaler Flaw for Root Access

A newly patched security vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances is under active exploitation by unknown threat actors, giving them full root-level control of affected devices and enabling the deployment of previously unseen post-exploitation tools. The attacks, observed in September 2026 by Mandiant Consulting and Google Threat Intelligence Group (GTIG), have already compromised dozens of organisations across North America and Europe, targeting government, financial services, technology, education, and legal and professional services sectors.

At the centre of the campaign is CVE-2026-88772, a memory overflow bug in how the NetScaler Packet Processing Engine (NSPPE) handles Datagram Transport Layer Security (DTLS) handshakes. With a severity score of 9.5 out of 10, the flaw allows an unauthenticated attacker to send specially crafted or fragmented DTLS record headers that corrupt heap memory and divert control flow, ultimately executing arbitrary shellcode with root operating system privileges on the underlying FreeBSD platform. In short, a remote hacker can take complete control of the appliance without needing any login credentials.

Once in, the attackers modify the Apache httpd.conf configuration file so that Debian software package files with a .deb extension are treated as PHP scripts. They then drop a series of lightweight PHP web shells into the /netscaler/gui/vpn/scripts/linux/ directory, disguising them as ordinary files. The most notable of these is WHIPSHOT, a web shell that extracts Base64-encoded commands and payloads directly from HTTP headers, executes them, and returns the results, effectively hiding its command-and-control traffic inside normal-looking web requests. Alongside WHIPSHOT, the attackers deploy a Python-based TCP tunneler called SLAPSHOT, which acts as a bridge into the internal network: it accepts commands from WHIPSHOT and forwards arbitrary TCP streams to hosts inside the victim’s environment, facilitating lateral movement, credential theft, and reconnaissance. To cover its tracks, SLAPSHOT removes its port and lock files and terminates its own process if no active sessions are received for ten minutes.

The infection chain also involves a covert configuration hook that maps incoming HTTP requests ending in .ico under /vpn/media/ to a matching .sig file in the web shell directory. For example, a request to /vpn/media/e6ee7c85.ico is silently served by the PHP web shell e6ee7c85.sig, making it appear as a simple image fetch. Google noted that in at least one case, web server access logs showed GET requests returning HTTP 404 responses but with elevated processing durations and multi-kilobyte response sizes, while subsequent attempts to access non-existent .sig files generated missing-file errors in httperror-vpn logs, suggesting the attackers managed similar web shells across multiple compromised environments.

Adding to the urgency, GreyNoise reported a sharp increase in exploitation attempts targeting a second vulnerability, CVE-2026-88771, beginning September 28, 2026, with a surge around 10:30 p.m. EDT the same day. CERT-EU also issued an alert, describing attackers filling HTTP logs with Base64-encoded payloads in the User-Agent string and hammering authentication logs in the hope that their exploit trigger is the last log line when a specific error function is called. The intelligence firm noted that while the exploitation mechanisms overlap with those observed by Google, the actors and tooling differ, indicating multiple independent groups are now actively exploiting these flaws. According to Censys, as of September 28 there were 42,735 hosts and 323,527 web properties running NetScaler ADC or Gateway, with the United States accounting for 32% of the exposed hosts, followed by Germany at 13% and the Netherlands, United Kingdom, and Switzerland at around 4% each; many of these are virtual appliances running in public clouds from Microsoft and Amazon.

For any organisation relying on edge devices like application delivery controllers and VPN gateways, the campaign is a stark reminder that these internet-facing appliances sit outside the reach of traditional endpoint detection and response tools and often store or process credentials that can unlock deeper network access. Immediate patching is the most critical defence. Organisations managing their own infrastructure can strengthen their posture by working with security-focused IT partners that offer continuous monitoring and rapid incident response. For those who need expert guidance, AEU-I provides security-first infrastructure and consulting services that help businesses identify exposed appliances, apply patches promptly, and harden configurations against such intrusions.