Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

Tools and scripts by Arctic Wolf. Contribute to rtkwlf/wolf-tools development by creating an account on GitHub.

Taking 'execute logging' a bit too literally - CVE-2026-88771

Google’s Mandiant and GTIG reported ongoing exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, which attackers used to gain root access and deploy web shells. The campaign, active since at least early September, affected organizations across multiple sectors in North America and Europe, with more than 100 victims potentially impacted. #CVE-2026-88771 #CVE-2026-88772...

Citrix confirms active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical NetScaler RCE flaws affecting ADC and Gateway systems.

Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks. Mandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT. #Citrix #NetScaler #CVE-2026-88771 #CVE-2026-88772 #Mandiant #GreyNoise #WHIPSHOT #SLAPSHOT

Curate Feeds | Make Collections | Customize Email Briefs

Mandiant and GTIG identified active exploitation of CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway, with intrusions using custom tooling to gain root access, persist, and move into internal networks. The campaign deployed WHIPSHOT and SLAPSHOT to hide C2 in HTTP headers, proxy traffic for reconnaissance and credential theft, and abuse modified web server settings, while Citrix also warned that CVE-2026-88771 is being actively exploited. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #WHIPSHOT #SLAPSHOT

Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices. Rumors about their existence and active exploitation popped up on Reddit on Friday, fueled by warnings from IT suppliers, who apparently got the information from the Dutch National Cyber Security Center (NCSC-NL). According to security researcher Kevin Beaumont, European government sources have been warning …

Citrix patches exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5. Update to 14.1-73.37 or 13.1-64.23 now.