Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware

What happened?

A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware. Tracked as CVE-2026-88771, the vulnerability stems from improper input validation and can allow an unauthenticated attacker to execute commands remotely. Citrix gives it a CVSS 4.0 score of 9.5 and says exploitation does not require an optional feature to be enabled. The company has confirmed attacks against unpatched systems. The activity puts internet-facing NetScaler systems at risk of more than a brief intrusion attempt.

Key details

• Staged exploitation chain involves log poisoning, command execution and attempts to place multiple web shells on the appliance.
• Rust-based FreeBSD x64 malware payload delivered during activity, named kw2-freebsd-x64-s11 and placed at /var/kw2s11.
• Researchers observed burst of similar activity from at least 26 source IP addresses over roughly six to seven minutes.
• Citrix provides fixed builds: NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23 or later; Zscaler lists 14.1-73.46 and 13.1-64.29 or later.
• Organizations should preserve logs and review authentication and access logs for suspicious markers, shell syntax, unexpected downloads and unusual requests after patching.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.