Attackers Exploit Two Citrix NetScaler Zero-Days, Reaching Root Access
Summary
Mandiant and GTIG report exploitation of two Citrix NetScaler zero-days since early September, affecting dozens of organizations. Attackers used web shells, configuration changes and SLAPSHOT tunneling; patching alone may not remove access or address stolen credentials.
Key points
- CVE-2026-88771 and CVE-2026-88772 were exploited as zero-days in Citrix NetScaler ADCs and Gateways; CVE-2026-88772 requires DTLS to be enabled.
- CVE-2026-88772 exploitation bypassed authentication and enabled root-level access on vulnerable appliances.
- Mandiant and Google Threat Intelligence Group identified dozens of impacted organizations across North America and Europe, including government and several business sectors.
- Attackers used web shells and configuration tampering for persistence, including methods to disguise web shell execution as image requests.
- A TCP tunneling tool dubbed SLAPSHOT was used to proxy traffic into internal networks.
- Researchers warn that upgrading to a fixed version alone may not evict attackers or address risks from stolen credentials; organizations should follow hunting, containment and remediation guidance.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Heap memory boundary corruption
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1059.004 · Unix ShellThe exploit executed arbitrary shellcode with root-level privileges on the underlying FreeBSD platform.T1090 · ProxyThe SLAPSHOT TCP tunneling tool proxied traffic into internal networks.T1505.003 · Web ShellAttackers deployed web shells on targeted NetScaler appliances to execute commands and maintain persistence.T1574.010 · Services File Permissions WeaknessAttackers modified httpd.conf so the built-in web server handled .deb files as PHP scripts, enabling covert staging and execution of web shells.
CVE
CVE-2026-88771Threat actors exploited two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772.CVE-2026-88772Advanced, suspected state-sponsored threat actors are likely behind initial intrusions exploiting CVE-2026-88772 in Citrix NetScaler ADCs and Gateways, with dozens of organizations impacted across North America and
People
Vendors
Citrixsuspected state-sponsored threat actors are likely behind initial intrusions exploiting CVE-2026-88772 in Citrix NetScaler ADCs and Gateways, with dozens of organizations impacted across North America and Europe.GoogleMandiant and Google Threat Intelligence Group (GTIG) know of dozens of impacted organizations across North America and Europe, he added, “including in the government, financial services, education, telecommunications,MandiantMandiant and GTIG found attackers used web shells, configuration tampering, and SLAPSHOT tunneling for persistence and internal network access, and they warn that patching alone will not remove the threat or address
Products
Tools
Industries
Educationacross North America and Europe, he added, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.”Financial Servicesof impacted organizations across North America and Europe, he added, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.”Governmentknow of dozens of impacted organizations across North America and Europe, he added, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.”legal and professional servicesadded, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.”TelecommunicationsNorth America and Europe, he added, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.”