Critical Citrix NetScaler RCE Exploited to Install Web Shells and Malware

A critical remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being actively exploited to run commands on exposed appliances, install web shells and deploy malware.

Tracked as CVE-2026-88771, the flaw permits an unauthenticated attacker to execute commands remotely. Citrix disclosed the vulnerability on September 27, 2026, and confirmed that some unpatched appliances were being exploited.

According to a Zscaler ThreatLabz analysis, the vulnerability carries a CVSS score of 9.8 under v3.1 and 9.5 under v4.0. The activity is particularly dangerous because NetScaler devices commonly sit at the edge of networks and provide remote access and application traffic handling, making them valuable targets.

A web shell can provide persistent access to a compromised appliance, and a separate malware implant can give attackers an additional foothold. The campaign also demonstrates that patching alone may not be sufficient: organizations must verify whether attackers already modified files, settings or logs.

Zscaler ThreatLabz researchers identified a staged exploitation chain that used log poisoning, command execution, attempts to place web shells and delivery of a FreeBSD malware implant.

How the exploitation chain worked

In the observed attacks, initial requests to common NetScaler web paths included a distinctive INDEX: marker and encoded content in the User-Agent header. Those requests were intended to get attacker-controlled data written into web access logs; the initial requests did not themselves execute the full payload.

Attackers then sent crafted authentication requests that mimicked a Packet Processing Engine (PPE) failure message. A vulnerable diagnostic process — a Perl script used for diagnostics — later processed matching log entries and failed to safely handle attacker-controlled characters in the forged message.

When that script processed the poisoned log entry, appended commands could execute with the script’s privileges. This delayed, multi-step approach explains why seemingly ordinary web or login traffic can be part of a larger attempt to compromise an appliance.

The payloads observed attempted to create web-accessible files, enable PHP or Perl handling on the web server, and place files named Nx_7508.php and Nx_7508.pl. Researchers also observed attempts to download and run a 64-bit FreeBSD binary named kw2-freebsd-x64-s11.

Zscaler reported that the infrastructure used to serve the FreeBSD binary had previously appeared in activity targeting Magento and Adobe Commerce via CVE-2026-75650 (style-smuggling activity referenced as StyleSmuggler). That overlap is an investigative lead but not definitive proof that the same actor conducted both campaigns.

Previous reporting has documented other incidents where attackers used NetScaler vulnerabilities to deploy web shells. Those earlier incidents provide context but relate to different flaws and should not be treated as evidence that the same operators are responsible for this exploitation chain.

What organizations should do

Citrix published fixed builds. According to the Zscaler report, the affected builds and minimum patched versions include:

• NetScaler ADC and Gateway: 14.1-73.46 or later, and 13.1-64.29 or later.
• 14.1-FIPS: 14.1-73.46 FIPS or later.
• 13.1-FIPS and 13.1-NDcPP: 13.1.37.283 or later.

Administrators should verify the exact build running on their appliances and upgrade promptly. Before updating, preserve relevant evidence where possible, including remote syslog data, technical support bundles and any available core dumps.

After or while preparing to update, review authentication and web access logs for suspicious INDEX: User-Agent values; forged “pitboss PPE” failure messages; unexpected requests to the HTTP and authentication paths listed in the indicators section below; and appliance-initiated connections to unfamiliar hosts. Also inspect for unapproved web files, changed web-server settings and suspicious processes.

If compromise is suspected, isolate the appliance while preserving evidence and rotate credentials, tokens and certificates that the appliance could access. Patching prevents further exploitation of the vulnerability but does not remove an existing web shell or implanted malware — remediation teams must search for and remove any malicious files or processes found.

Responders should use the indicators provided below for this incident and consult the relevant vendor guidance for any other NetScaler flaws when comparing current activity to earlier disclosures.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, [.]) to prevent accidental resolution or linking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal or your SIEM.