Critical NetScaler Vulnerabilities Exploited for Remote Code Execution

• •CVE-2026-88771 and CVE-2026-88772 are critical vulnerabilities with a CVSS score of 9.5.
• •Over 50,000 NetScaler appliances are exposed globally, making them prime targets.
• •Attackers are using advanced techniques, including PHP web shells and the Platypus C2 framework.

Threat actors are exploiting two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in Citrix NetScaler ADC and Gateway appliances, allowing unauthenticated remote code execution. CVE-2026-88771, identified as a pre-authentication RCE flaw, has been since at least September 21, 2026, while CVE-2026-88772, a memory overflow bug, was also weaponized in September 2026. Attackers are deploying PHP web shells and a Go-based command-and-control framework named Platypus to maintain persistence and facilitate further intrusions. The vulnerabilities affect critical sectors including government and finance, with over 50,000 exposed instances of NetScaler appliances globally. Patches have been released, but the rapid weaponization indicates a significant risk for organizations that have not yet updated their systems.