CriticalZero-DayCVE-2026-88771
Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data
Cyber Security News·Source published ·1 min read
What happened?
Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration data. The activity goes beyond simple testing, with malicious scripts designed to maintain access and send stolen files to attacker infrastructure. The flaw affects NetScaler ADC and NetScaler Gateway and allows command execution before authentication. Citrix rates it 9.5 under CVSS 4.0 and says vulnerable default deployments are exposed without any extra feature enabled.
Key details
- Hackers exploit a critical Citrix NetScaler flaw to run commands, install web shells, and steal configuration data.
- The vulnerability affects NetScaler ADC and NetScaler Gateway, allowing unauthenticated command execution.
- Citrix rates the issue 9.5 CVSS and says default deployments are exposed without extra features.
- The Perl payload creates a superuser account, archives the config directory, and attempts to upload the archive.
Affected
- NetScaler Gateway is vulnerable.
Fixes and mitigations
- Citrix released fixes in 14.1-73.37 and 13.1-64.23 builds.
What to look for
- Suspicious authentication fields contain commands for downloading or archiving files.
- Shell permissions changed to 6555 and a PHP web shell was installed.
- Perl payload creates a superuser account, archives config, and tries to upload it.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.