Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

Advanced threat actor exploited CVE-2026-88772, one of the two recently disclosed NetScaler zero-day flaws, for weeks.

Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

Advanced threat actor exploited CVE-2026-88772, one of the two recently disclosed NetScaler zero-day flaws, for weeks.

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.

Advanced threat actor exploited CVE-2026-88772, one of the two recently disclosed NetScaler zero-day flaws, for weeks.

Google’s Mandiant and GTIG reported ongoing exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, which attackers used to gain root access and deploy web shells. The campaign, active since at least early September, affected organizations across multiple sectors in North America and Europe, with more than 100 victims potentially impacted. #CVE-2026-88771 #CVE-2026-88772...

Citrix confirms active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical NetScaler RCE flaws affecting ADC and Gateway systems.

Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks. Mandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT. #Citrix #NetScaler #CVE-2026-88771 #CVE-2026-88772 #Mandiant #GreyNoise #WHIPSHOT #SLAPSHOT

Curate Feeds | Make Collections | Customize Email Briefs

Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices. Rumors about their existence and active exploitation popped up on Reddit on Friday, fueled by warnings from IT suppliers, who apparently got the information from the Dutch National Cyber Security Center (NCSC-NL). According to security researcher Kevin Beaumont, European government sources have been warning …

Mandiant and GTIG identified active exploitation of CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway, with intrusions using custom tooling to gain root access, persist, and move into internal networks. The campaign deployed WHIPSHOT and SLAPSHOT to hide C2 in HTTP headers, proxy traffic for reconnaissance and credential theft, and abuse modified web server settings, while Citrix also warned that CVE-2026-88771 is being actively exploited. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #WHIPSHOT #SLAPSHOT

Citrix patches exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5. Update to 14.1-73.37 or 13.1-64.23 now.

Since at least early September 2026, attackers have taken root-level control of Citrix NetScaler appliances without a password. Mandiant and Google Threat Intelligence Group (GTIG) traced the break-ins to a Citrix NetScaler zero-day, CVE-2026-88772. In their new report on the campaign, the researchers describe custom web shells hidden behind fake image requests. At a Glance Actor