Act
archived
Citrix NetScaler Zero-Day Exploited to Deploy Web Shells
- Engineer — Act: CISA KEV-listed with public PoC and confirmed active exploitation on a common edge appliance — patch NetScaler immediately and audit appliances for web shell artifacts and tunneling malware in web roots and process trees.
- SOC/IR — Act: Attackers are deploying web shells and tunneling malware post-exploitation, then pivoting inward — sweep NetScaler appliances for unexpected child processes and outbound tunnels, and hunt for lateral movement originating from NetScaler IPs since exploitation began.
- Leader — Act: A CISA-KEV-listed zero-day on a widely deployed edge appliance with confirmed credential theft and internal network spread warrants immediate confirmation of NetScaler usage and a status check from engineering before leadership or customers raise the question.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.