What happened
Cybersecurity firms have reported that attackers are actively exploiting a zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772. This flaw enables remote code execution, allowing malicious actors to gain persistent access to affected systems. During the attack, hackers deploy custom web shells and tunneling malware, which facilitate maintaining control over compromised systems. The actors have also utilised this access to escalate privileges to root level, exfiltrate credentials, and infiltrate internal network segments, thereby increasing the potential scope of compromise. The vulnerability was exploited prior to the availability of a vendor patch, making remediation challenging and heightening the severity of the threat.
Who is affected
Organizations running Citrix NetScaler are impacted by this zero-day vulnerability. The exploitation involves specific capabilities within the affected deployments that are vulnerable to the CVE-2026-88772 flaw. Since the attack is actively occurring in the wild, any organisation employing Citrix NetScaler software is at potential risk. Affected deployments should be considered as potentially compromised until appropriate mitigation measures are implemented.
Recommended actions
- Assess network infrastructure to identify Citrix NetScaler instances and confirm exposure to the vulnerability.
- Implement traffic monitoring and intrusion detection measures focusing on web shell signatures and tunneling malware activity.
- Isolate affected systems from the broader network to prevent lateral movement during investigation and cleanup processes.
- Apply mitigations aligned with the actions suggested by security advisories or the vendor once they become available, prioritising detection and containment of malicious activity.
Indicators of compromise
Reported indicators include the deployment of custom web shells and tunneling malware on affected Citrix NetScaler instances, as well as unusual network traffic profiling. Specific IOC details have not been provided at this time.
