NetScaler C2 Automates Mass Exploitation of Citrix CVE-2026-88771
Summary
SOCRadar details NetScaler C2, a framework exploiting CVE-2026-88771 to find vulnerable Citrix appliances, inject commands, and deploy a polling agent. It reports no confirmed victim count and recommends upgrading, isolating, and checking for compromise.
Key points
- CVE-2026-88771 is an unauthenticated log-injection flaw that can enable root command execution on affected Citrix NetScaler ADC and Gateway appliances.
- NetScaler C2 automates target discovery, version checks, exploitation across multiple HTTP endpoints, and deployment of a command-polling agent.
- The exploit injects commands into logs; a background daemon may process them up to 24 hours later.
- The agent communicates over HTTP, with DNS beacons used to confirm exploitation when HTTP command-and-control is unavailable.
- SOCRadar did not retrieve an active C2 instance and could not independently determine how many appliances were compromised.
- Citrix fixed CVE-2026-88771 in specified NetScaler releases; organizations should upgrade, isolate vulnerable systems, and check logs, processes, files, and network activity for indicators.
Article Details
- Attack Vectors
- NetScaler C2 discovers internet-exposed Citrix NetScaler ADC and Gateway devices using FOFA, fingerprints their versions, and targets vulnerable appliances at scale.
- The framework exploits CVE-2026-88771 by injecting commands through unauthenticated HTTP login fields and User-Agent headers; the admautoregd daemon later processes the injected log entries and executes commands as root.
- On successful exploitation, an injected command retrieves a bootstrap script and agent from the C2 server. The agent polls for commands over HTTP and returns results; DNS beacons confirm exploitation when HTTP C2 is unavailable.
- Defensive Notes
- Isolate vulnerable systems and upgrade affected NetScaler deployments to the fixed versions specified by Citrix. SAML-configured appliances also require the fixes for CVE-2026-88779.
- Search ns.log archives for the reported injection strings and review outbound connections for up to 24 hours after a matching log entry.
- Inspect /tmp/ for the hidden agent file /tmp/.nsagent, review processes for unexpected shells, and check network and proxy logs for the reported C2 paths.
- If compromise indicators are found, preserve forensic evidence, contain the appliance, and deploy a new instance on a fixed build rather than relying on an upgrade to remove compromise artifacts. Restrict management interfaces from the public internet.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]143[.]130[.]195 | NetScaler C2 server IP used for HTTP payload delivery and C2 on port 8899, and DNS beacons on port 53. |
| SHA256 | 4992f575f3f1fc448cf54a4a0ce13cf6548790777abe0af1f935663498ea5639 | SHA-256 hash identified for the NetScaler C2 targets.py script. |
| SHA256 | 69a34c591eaaa2cbecaeed10c303b8dcf04c846b8408491da5452b9cfc93f686 | SHA-256 hash identified for the NetScaler C2 probe.py script. |
| SHA256 | 8588d11874ab52a1637953dc5538984647023d00b529f695fbd0e40cf8e5e852 | SHA-256 hash identified for the NetScaler C2 run.sh script. |
| SHA256 | a3e26053975daa0a12a4848ce9533e5c439617cd7f69851347be2061999b4cd4 | SHA-256 hash identified for the NetScaler C2 exploit.py script. |
| SHA256 | a9142989d912098856e58f2c74c2266e39150d50bc59722f915dade1ddfddf4a | SHA-256 hash identified for the NetScaler C2 c2_server.py script. |
| SHA256 | f9e06d412dee96d98db4d4588f0012af859cc11caaae3e130697f282447cf07f | SHA-256 hash identified for the NetScaler C2 pollctl.py script. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe agent is stored at /tmp/.nsagent, a hidden file path reported by the article.T1041 · Exfiltration Over C2 ChannelThe agent returns command results to the C2 through /r/<bid>?d=<hex>.T1059.004 · Unix ShellInjected shell commands are processed and executed by the admautoregd daemon; the framework also uses bash scripts.T1071.001 · Web ProtocolsThe agent polls the C2 for commands over HTTP.T1071.004 · DNSThe framework uses DNS out-of-band beacons to confirm successful exploitation when HTTP C2 cannot be established.T1105 · Ingress Tool TransferThe bootstrap script downloads the agent from the C2 to /tmp/.nsagent.T1132.001 · Standard EncodingThe agent hex-encodes host details and command results sent to the C2.T1190 · Exploit Public-Facing ApplicationThe framework exploits CVE-2026-88771 through unauthenticated HTTP endpoints on exposed NetScaler appliances.T1543 · Create or Modify System ProcessThe article reports that the agent runs in the background and can be re-injected via admautoregd after appliance reboots.T1596.005 · Scan DatabasesNetScaler C2 uses FOFA queries to find exposed Citrix NetScaler ADC and Gateway hosts.
CVE
Vendors
Products
Citrix NetScaler GatewayOn September 27, 2026, Citrix released a security bulletin regarding multiple vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway.NetScaler ADCOn September 27, 2026, Citrix released a security bulletin regarding multiple vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway.