##
### Citrix NetScaler CVE-2026-88771: Indicators of Compromise
Indicators of Compromise (IoCs) observed by watchTowr Intel during in-the-wild exploitation of CVE-2026-88771, an unauthenticated command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway.
Indicators in this repository were captured across our sensor network of real NetScaler appliances, and is shared to help defenders hunt for exploitation and post-exploitation activity in their own environments.
* iocs.md \- indicators and hunting guidance:
* Host-based artifacts (dropped files, backdoor accounts, backdoor keys)
* Network indicators (source IP addresses, out-of-band callback domains, Sliver C2)
* Hunting commands for NetScaler appliances
* Citrix Security Bulletin CTX697096:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
