Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells
In October 2026, threat actors actively exploited CVE-2026-88771, a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway devices. The attackers leveraged this 9.5 CVSS-rated flaw to deploy sophisticated post-exploitation payloads, including Python reverse shells and Perl scripts that created superuser accounts, archived configuration data, and installed PHP web shells disguised as legitimate CSS resources. LevelBlue's research revealed exploitation attempts across multiple customer environments, with attackers using malicious authentication events containing 'pitboss' and 'NSPPE' strings to execute arbitrary commands and establish persistent access. This incident highlights the growing sophistication of network infrastructure attacks, where adversaries combine critical vulnerabilities with advanced evasion techniques to maintain persistence while blending malicious resources with legitimate web assets.
Kill Chain
