Act
archived
Active Exploitation of Citrix NetScaler ADC/Gateway Zero-Days (CVE-2026-88771/88772)
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed in-the-wild exploitation; CVE-2026-88772 achieves unauthenticated root access on NetScaler ADC/Gateway. Apply Citrix’s latest patches immediately, then audit NetScaler systems for WHIPSHOT PHP web shells and anomalous SLAPSHOT-style proxy traffic in access logs.
- SOC/IR — Act: Exploitation deploys custom tooling — WHIPSHOT (PHP web shell masking C2 in HTTP headers) and SLAPSHOT (Python proxy tunneler for internal recon and credential theft) — giving concrete hunt targets. Sweep NetScaler appliances for unexpected PHP files and unusual outbound proxy sessions, and hunt for lateral movement or credential-access activity originating from NetScaler hosts since early September 2026.
- Leader — Act: An active, multi-sector campaign (government, finance, legal, education in North America and Europe) exploiting edge appliances via authentication-bypass zero-days is a board-question-level event. Confirm whether Citrix NetScaler is in your environment or a key vendor’s, request Citrix incident status attestation, and brief leadership before this surfaces in the news.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.