Attackers Exploit Critical NetScaler Flaw for Unauthenticated Code Execution

Oct 16, 2026 · Original article ↗

Summary

Citrix confirmed active exploitation of CVE-2026-88771, a critical unauthenticated RCE flaw in NetScaler ADC and Gateway. Zscaler observed log poisoning, command execution, fingerprinting, web-shell attempts, and delivery of a FreeBSD implant.

Key points

CVE-2026-88771 affects NetScaler ADC and NetScaler Gateway and allows unauthenticated attackers to execute arbitrary commands.
Citrix confirmed exploitation on unmitigated appliances; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Zscaler observed access-log poisoning, pre-authentication command execution, appliance fingerprinting, and attempts to deploy multiple web shells.
The observed activity also included delivery of a FreeBSD x64 implant from infrastructure overlapping with activity previously associated with CVE-2026-75650.
Zscaler cautioned that infrastructure overlap is an investigative lead, not proof of shared threat-actor attribution.

Article Details

Vulnerability Types: Remote code execution
Severity: Critical; CVSS v3.1 9.8 according to NVD and CVSS v4.0 9.5 according to the Citrix security bulletin.
Exploitation Status: active
Exploit Availability: unknown
Patch Status: unknown

Indicators of compromise

Type	Indicator	Context
IPV4	`100[.]38[.]125[.]66`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`102[.]213[.]132[.]123`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`102[.]222[.]146[.]45`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`103[.]181[.]212[.]245`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`103[.]197[.]249[.]161`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`103[.]83[.]146[.]100`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`111[.]92[.]128[.]89`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`114[.]145[.]49[.]215`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`120[.]244[.]160[.]182`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`125[.]62[.]88[.]26`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`130[.]12[.]182[.]7`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`154[.]183[.]158[.]198`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`154[.]241[.]254[.]9`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`174[.]60[.]63[.]37`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`177[.]52[.]203[.]23`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`183[.]63[.]88[.]227`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`190[.]117[.]56[.]56`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`195[.]62[.]37[.]119`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`207[.]48[.]184[.]10`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`45[.]153[.]212[.]101`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`46[.]233[.]40[.]20`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`46[.]236[.]167[.]143`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`46[.]33[.]33[.]95`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`49[.]150[.]197[.]119`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`78[.]190[.]152[.]64`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`81[.]10[.]79[.]197`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`82[.]167[.]14[.]7`	Listed as a potential network indicator in connection with observed exploitation attempts.
IPV4	`95[.]105[.]74[.]172`	Listed as a potential network indicator in connection with observed exploitation attempts.