Hackers exploit Citrix NetScaler zero-day to deploy web shells

[XploitLK-Bot]

Attackers have been exploiting a zero-day vulnerability in Citrix NetScaler to compromise exposed appliances and move deeper into victim networks. According to cybersecurity firms tracking the activity, the flaw is being used to deploy custom web shells and tunneling malware, granting attackers root-level access, enabling credential theft, and facilitating lateral movement into internal environments.

The vulnerability is tracked as CVE-2026-88772 and has been exploited in the wild as a zero-day before patches or mitigations were available.

Key points from the reporting:

• Citrix NetScaler appliances are the targets of the exploitation campaign.
• The vulnerability is identified as CVE-2026-88772.
• Attackers deployed custom web shells for persistent remote access.
• Tunneling malware was used to establish covert channels into internal networks.
• Successful exploitation allowed root access on affected systems.
• Stolen credentials were used to spread further within victim environments.

Organizations running Citrix NetScaler should treat this as an urgent exposure risk. Until official patches or mitigations are confirmed, defenders should review appliance logs for signs of web shell deployment and unusual outbound tunneling activity, restrict management interface exposure where possible, and rotate credentials that may have been accessible from compromised systems.

Source: Publication Name

Has your organization reviewed its NetScaler appliances for signs of compromise since this campaign came to light?