Citrix NetScaler zero-day attacks add web shells, root access and tunneling malware

Feeds.4Sysops •IT News • September 29, 2026

Citrix NetScaler zero-day exploitation is escalating from patch alerts to full post-compromise tradecraft: attackers are using CVE-2026-88772 and the separately exploited CVE-2026-88771 to plant web shells, gain root access, steal credentials and move into internal networks. The campaign, already flagged in earlier 4sysops coverage of the NetScaler RCE flaws , now appears to have been active since at least early September across government, finance, education, legal and professional-services targets. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, and set a patch deadline for federal agencies by September 30. Citrix has urged organizations to apply patches immediately and assess for potential compromises before patching. The vulnerabilities were discovered during incident investigations and were exploited before public disclosure. Affected systems are widely used in enterprise environments, making the impact potentially severe. 67 sources 82

Extracted Entities

Citrix NetScaler zero-day attacks add web shells, root access and tunneling malware

The full story

Extracted Entities

Attack Types (2)

Companies (2)

CVEs (2)

Industries (2)

MITRE ATT&CK (2)