Hackers Exploit Citrix NetScaler Zero-Days to Gain Root Access and Deploy Web Shells

Threat actors are actively exploiting two critical Citrix NetScaler ADC and NetScaler Gateway zero-day vulnerabilities to gain initial access, establish root-level persistence, deploy disguised PHP web shells, and tunnel into internal victim networks.

Mandiant Consulting and Google Threat Intelligence Group (GTIG) said the campaign targeting CVE-2026-88772 has been active since at least early September and has likely affected organizations in North America and Europe across government, financial services, technology, education, and legal and professional services.

Citrix has also confirmed active exploitation of CVE-2026-88771. Both flaws carry a CVSS v4 score of 9.5.

Hackers Exploit Citrix NetScaler Zero-Days

CVE-2026-88772 is a memory-overflow vulnerability in NetScaler’s DTLS processing that affects appliances with DTLS enabled, a default configuration on VPN virtual servers.

GTIG’s telemetry indicates attackers send malformed or fragmented DTLS record headers during a pre-authentication handshake, causing heap-memory corruption in the NetScaler Packet Processing Engine, or NSPPE.

Successful exploitation can divert execution to attacker-controlled shellcode running with root privileges on the appliance’s FreeBSD operating system. The intrusion set then modifies the appliance’s Apache configuration to execute files with misleading extensions.

Mandiant observed actors registering .deb and .sig files as PHP handlers and using URL aliases that map seemingly benign icon requests, such as /vpn/media/<name>.ico, to malicious .sig payloads stored in VPN script directories.

The technique helps web shells blend into paths and extensions commonly associated with legitimate NetScaler client components.

Researchers identified several lightweight installer shells, often using filenames resembling “nginstaller,” which accept Base64-encoded commands from uncommon HTTP headers.

Some variants return spoofed HTTP 404 responses while still executing commands, reducing the likelihood that an operator or automated scanner recognizes the request as a successful web-shell interaction.

To preserve elevated access after the initial exploit, the attackers set the SUID bit on /bin/sh using chmod u+s /bin/sh. That change lets processes launched through the web server’s lower-privileged context run with root-level permissions.

The attackers then restart Apache or reboot the appliance to activate their altered configuration. GreyNoise separately observed an attempted chain that set both SUID and SGID permissions on /bin/sh before installing a password-protected hidden web shell.

Mandiant named the larger PHP backdoor WHIPSHOT, which relays attacker commands through a local proxy and disguises command-and-control traffic in HTTP requests.

Its companion, SLAPSHOT, is a Python TCP tunneler that binds to a localhost port and enables connections to internal systems. In at least one intrusion, the operators used the proxy to manually perform internal reconnaissance and steal credentials.

Defenders should treat suspicious NetScaler appliances as potentially compromised before patching.

Key indicators include unexpected AddHandler, AliasMatch, or php_flag entries in /etc/httpd.conf; executable text files in VPN plug-in directories; /tmp/.uxdport or /tmp/.uxdlock; SUID permissions on /bin/sh; anomalous Python processes; and DTLS handshake failures followed by NSPPE crashes.

Citrix urges customers to upgrade affected 14.1 appliances to version 14.1-73.37 or later and 13.1 appliances to version 13.1-64.23 or later. Organizations using FIPS or NDcPP editions must install their corresponding fixed releases.

Patching is essential, but it does not remove an attacker’s persistence mechanisms, making forensic review, appliance isolation, credential rotation, session revocation, and internal lateral-movement hunting equally important.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team