Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
-
Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations across North America and Europe.
The activity was observed by Mandiant Consulting and the Google Threat Intelligence Group (GTIG) in September 2026. Targeted sectors include:
- Government
- Financial services
- Technology
- Education
- Legal and professional services
The flaw is being exploited to gain root access on affected appliances, after which the attackers deploy the WHIPSHOT and SLAPSHOT payloads.
If your organization runs NetScaler ADC or NetScaler Gateway, it is worth reviewing your exposure and confirming that the relevant patches are applied.
Source: The Hacker News
Has anyone seen signs of this activity in their environment, and how are you handling mitigation?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login