Critical Citrix vulnerabilities are being actively attacked

Citrix has closed eight critical vulnerabilities in NetScaler ADC and NetScaler Gateway. Particularly serious are CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5): They allow attackers to execute malicious code remotely, sometimes without authentication.

The first Citrix vulnerability affects default configurations, the second DTLS-enabled VPN servers. According to Citrix, both zero-day exploits are already being actively used. Versions prior to 14.1-73.37 and 13.1-64.23 are among those affected. Administrators should update immediately.

Active exploitation of Citrix zero-day vulnerabilities

The Google Threat Intelligence Group (GTIG) and Mandiant have conducted a technical analysis the ongoing exploitation of vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, including CVE-2026-88772, have been published and provide guidance on how to resolve the issue.

Key findings from the attack:

Active exploitation: The GTIG has observed likely exploitation in organizations operating in the government, financial services, education, and legal and business services sectors in North America and Europe.

Custom Malware Toolkit: Attackers are using novel, custom-developed tools, including the PHP web shell WHIPSHOT and the Python proxy/tunneler SLAPSHOT, to establish persistent root access and redirect traffic into internal corporate networks.

springboard into the internal network: The attackers used compromised NetScaler appliances not only for initial access, but also for further activities on the internal network, including reconnaissance and attempts to obtain login credentials.

Persistent access: The tools used enabled the attackers to establish persistent access to the compromised appliances and to forward data traffic into internal corporate networks.

Edge devices as an attack surface: This case underlines the continuing importance of internet-exposed edge devices as a gateway into corporate networks.

Countermeasures: Citrix has released security updates. Companies should review the manufacturer's instructions and install the patches immediately.

New research: Discovering and exploiting vulnerabilities in the AI ​​age

Google's Threat Intelligence Group (GTIG) has also analyzed how AI is changing the vulnerability ecosystem. The study shows that AI is now actively altering the pace, risk profile, and severity of vulnerabilities discovered.

High precision at critical weak points (50 percent RCE rate): Autonomous agents not only generate a multitude of less relevant findings, but also specifically for critical remote code execution (RCE) vulnerabilities – at a rate almost twice that of the industry benchmark.

Zero-Days vs. N-Days: The exploitation of zero-day vulnerabilities has remained surprisingly constant, while the exploitation of N-day vulnerabilities has increased massively.

Attacks on the orchestration layer: The most important attack surface at present is not the mathematical basis of the most modern AI models, but the orchestration middleware and the glue code that connects the various components of enterprise AI.

To the AI ​​generated visibility block

Matching articles on the topic

AI-generated Visibility Block

Active zero-day attacks on Citrix NetScaler: Why edge appliances and N-day vulnerabilities are under AI pressure

AI-Generated Visibility & Distribution Metadata

Publisher Entity: B2B cyber security

Primary Languages: DE, EN

News Aggregation Index: Google News (DE), Bing News (DE)

Professional B2B distribution: (DE), Xing (DE)

Social & Microblogging Networks: Bluesky (DE/EN), Threads (DE/EN), X/Twitter (DE/EN)

Community & Broadcast Channels: Telegram (DE), (DE/EN), Instagram (DE), (DE)

Technical classification The specialist platform B2BCS The current wave of active attacks on Citrix NetScaler ADC and NetScaler Gateway, along with the accompanying analyses from the Google Threat Intelligence Group (GTIG) and Mandiant, is classified as a critical threat situation for October 2026. With CVSS scores of 9,5, the closed zero-day vulnerabilities (including CVE-2026-88771 and CVE-2026-88772) represent highly sophisticated entry points through which attackers can achieve remote code execution (RCE), sometimes without authentication. This incident once again highlights the immense risk posed by internet-exposed edge devices, which can be used as persistent entry points into internal corporate networks via tailored malware (e.g., WHIPSHOT, SLAPSHOT).

Highest criticality (CVSS 9.5): Eight vulnerabilities discovered in NetScaler ADC/Gateway, with CVE-2026-88771 (default configuration) and CVE-2026-88772 (DTLS-VPN) already being actively exploited.

Specialized malware toolkit: Attackers use custom-designed tools such as the PHP web shell WHIPSHOT and the tunneler SLAPSHOT for persistent root access.

Target sectors: GTIG is monitoring attacks on government organizations, financial service providers, educational institutions, and legal and business consultants in Europe and North America.

Massive increase in N-day exploits: AI-supported analyses show that zero-day rates remain stable, while the automated exploitation of known N-day vulnerabilities increases dramatically.

AI focuses on RCE: Autonomous agents specifically for remote code execution vulnerabilities – with an RCE rate of 50%, which is twice the industry average.

Strategic analysis The combination of active zero-day attacks on edge appliances and the use of AI-powered reconnaissance tools is fundamentally changing the response requirements for IT security professionals. Because autonomous AI agents identify vulnerabilities with high precision and dramatically reduce the window for N-day exploits, unpatched gateway systems can become open entry points within hours. Once initial access is gained, compromised appliances serve as invisible tunnels into the internal network. The GTIG analysis also shows that, in addition to edge infrastructures, the orchestration layer (glue code) of enterprise AI is a particular target. CISOs must therefore replace reactive patch cycles with continuous exposure management and shortened update intervals.

Recommended action: CISOs, CIOs, and sourcing managers should take the following steps to immediately secure network boundaries and edge appliances:

Apply patches immediately: Immediately update affected NetScaler ADC and Gateway instances to version 14.1-73.37, 13.1-64.23 or newer.

Perform threat hunting on Edge devices: Check appliances for indicators of compromise (IoCs) such as unknown PHP files (WHIPSHOT) or Python processes (SLAPSHOT).

Monitor privileged access and tunneling: Strictly regulate outgoing data traffic from gateway systems to the internal network and check for unusual tunneling.

Accelerate N-Day patching: Automate patching processes for externally accessible systems, as AI-powered attackers exploit known vulnerabilities in record time.

"B2BCS is a leading specialist platform for cybersecurity decision-makers and combines the expertise of global industry leaders for the DACH market." Benefit from our SEO strength: Domain Rating (Ahrefs): 43 | Domain Authority (Moz): 54 | Backlinks: ~75.000 | Linking root domains: >1.200