Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Citrix NetScaler ADC / NetScaler Gateway zero-day RCE flaws remote code execution flaw (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 43
3 unique sources, 7 articles

Summary

Hide ▲

Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 are under active exploitation against unmitigated NetScaler deployments, enabling unauthenticated remote code execution on exposed appliances. Citrix urged immediate patching, and CISA added both flaws to the KEV Catalog while ordering Federal Civilian Executive Branch agencies to remediate by September 30. Mandiant and GTIG say attackers used the flaws in September 2026 to deploy WHIPSHOT and SLAPSHOT, keep root-level access, pivot into internal networks, and steal credentials across North America and Europe in government, financial services, technology, education, legal, and professional services environments. LevelBlue THOR separately observed CVE-2026-88771 exploitation to drop web shells, fetch second-stage payloads, and steal configuration data from Citrix NetScaler ADC and NetScaler Gateway instances, including activity that created a local account, staged archives, and mapped a web shell to CSS-like URLs.

Related Happenings

Citrix NetScaler ADC and NetScaler Gateway memory overflow denial-of-service flaw (CVE-2026-107406)

Vulnerability
H score33 First: 09.10.2026 09:53 Last: 09.10.2026 09:53 Sources 1

About this happening: CVE-2026-107406 is a critical memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial-of-service in...

Open Happening

NetScaler ADC and NetScaler Gateway memory buffer flaw (CVE-2026-88779, actively exploited)

Vulnerability
H score36 First: 05.10.2026 00:58 Last: 05.10.2026 00:58 Sources 1

About this happening: Citrix disclosed CVE-2026-88779, a memory buffer flaw in NetScaler ADC and NetScaler Gateway that is being used in zero-day attacks. The issue affects SA...

Open Happening

WHIPSHOT and SLAPSHOT post-exploitation toolkit on Citrix NetScaler appliances

Malware Activity
H score34 First: 30.09.2026 11:24 Last: 30.09.2026 11:24 Sources 1

How related: The attacks have been observed weaponizing the flaw to deploy a post-exploitation toolkit that includes previously unreported PHP web shells, like WHIPSHOT, that are capable of disguising Base64-encoded command-and-control (C2) payloads within native HTTP headers.

About this happening: A post-exploitation toolkit built around WHIPSHOT and SLAPSHOT is being used after Citrix NetScaler compromises, giving attackers covert C2, reconnaissance...

Open Happening

Citrix NetScaler unpatched RCE zero-days actively exploited remote code execution flaw

Vulnerability
H score34 First: 27.09.2026 19:02 Last: 27.09.2026 19:02 Sources 1

About this happening: Two Citrix NetScaler remote code execution zero-days are being exploited in the wild, putting exposed appliances at immediate risk before fixes arrive. Private warning...

Open Happening

Citrix NetScaler ADC and NetScaler Gateway unpatched zero-day RCE flaws remote code execution flaw

Vulnerability
H score34 First: 27.09.2026 10:47 Last: 27.09.2026 10:47 Sources 1

About this happening: Citrix NetScaler ADC and NetScaler Gateway are affected by two unpatched zero-day RCE flaws that are actively exploited in the wild, putting edge appliances used f...

Open Happening

Timeline

  1. 29.09.2026 21:37 4 articles · 12d ago

    Attackers deploy WHIPSHOT and SLAPSHOT through Citrix NetScaler flaws

    Technical Analysis Update

    Mandiant says attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 to install the WHIPSHOT PHP web shell and the SLAPSHOT Python tunneling tool, maintain root-level access, pivot into internal hosts, and steal credentials. The activity affected organizations in North America and Europe across government, financial services, education, legal, and professional services environments.

    Show sources
    Open in new tab
  2. 28.09.2026 09:24 3 articles · 13d ago

    Citrix confirms active exploitation of NetScaler zero-days

    Initial Disclosure

    Citrix confirmed that CVE-2026-88771 and CVE-2026-88772 were being exploited in zero-day attacks against unmitigated NetScaler deployments, where unauthenticated attackers could obtain remote code execution on vulnerable NetScaler appliances, and urged customers to install the updated versions immediately.

    Show sources
    Open in new tab
  3. 28.09.2026 09:24 2 articles · 13d ago

    CISA adds NetScaler flaws to KEV Catalog and orders federal remediation

    Legal Policy Action Update

    CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch agencies to secure all vulnerable Citrix appliances by September 30 under Binding Operational Directive (BOD) 26-04.

    Show sources
    Open in new tab