NetScaler Zero-Day Exploitation Escalates Into Widespread Attacks
Summary
Attackers are exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772. Researchers report opportunistic scanning, log poisoning and webshells, with over 100 victim organizations tracked; fewer than 10% of exposed hosts may be patched.
Key points
- Both CVE-2026-88771 and CVE-2026-88772 were exploited as zero-days; a public proof of concept for CVE-2026-88771 accelerated opportunistic attacks.
- Attackers are scanning for exposed, unpatched Citrix NetScaler ADC and Gateway devices and using log poisoning and webshells to maintain access and conceal activity.
- GreyNoise reported an unsuccessful exploitation attempt against a sensor on September 24, before public disclosure; other researchers later recorded live attempts after the proof of concept appeared.
- Researchers say they are tracking more than 100 victim organizations, each with a unique webshell. The article does not establish that all tracked organizations were independently confirmed as compromised.
- Kevin Beaumont estimates fewer than 10% of exposed hosts are patched and believes the initial attackers’ goal is espionage.
- Citrix released patches and a detection script, but warned that the script might miss actual compromises. The article reports no public proof of concept for CVE-2026-88772.
- Lupovis advised hunting for suspicious POST requests and DNS lookups ending in instances[.]httpworkbench[.]com; the article says collected data was sent to a Hetzner server at 138.199.200.90.
Article Details
- Incident Type
- Widespread exploitation of internet-exposed Citrix NetScaler ADC and Gateway deployments, involving log poisoning and webshell deployment.
- Operational Impact
- More than 100 victim organizations are reportedly being tracked. Researchers describe unique webshells on affected organizations; the article does not quantify operational disruption.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | instances[.]httpworkbench[.]com | Outbound DNS lookups ending in this domain were identified as an indicator that a host had been hit. |
| IPV4 | 138[.]199[.]200[.]90 | Hetzner server identified by Lupovis as the destination for exfiltrated data. |
CVE
People
Vendors
Products
NetScaler ADCA widespread wave of exploitation is targeting vulnerable, internet-exposed Citrix NetScaler ADC and Gateway deployments after a proof-of-concept for CVE-2026-88771 was published.NetScaler Gatewaysays it detected a malicious cyber actor attempting zero-day exploitation against a Citrix NetScaler Gateway on September 24, more than three days before public disclosure.