Mandiant Consulting and Google Threat Intelligence Group reported active exploitation of two zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway appliances. CVE-2026-88772 enables attackers to bypass authentication by exploiting a heap memory boundary corruption in the NetScaler Packet Processing Engine during DTLS handshake processing, resulting in root-level code execution on FreeBSD. Post-exploitation, attackers deploy custom PHP web shells (WHIPSHOT) disguised via web server configuration changes, and a Python tunneler (SLAPSHOT) for proxying traffic into internal networks. Persistence is achieved by configuring the web server to execute files with deceptive extensions (.deb, .sig) as PHP scripts and by setting the setuid bit on /bin/sh to elevate privileges for web shell execution. The attackers use these tools for internal reconnaissance and credential theft. Citrix has provided official guidance and recommended patches for these vulnerabilities.

Successful exploitation grants attackers root-level access to Citrix NetScaler appliances, allowing them to install persistent web shells and tunneling tools. This enables internal network reconnaissance, credential theft, and potential lateral movement within victim environments. The vulnerabilities have been actively exploited in the wild against organizations in government, financial services, technology, education, and legal sectors in North America and Europe. The root-level compromise and stealthy persistence mechanisms significantly increase the risk and impact of these intrusions.

Citrix has issued official guidance and recommended updates to address these vulnerabilities. Defenders should prioritize applying the vendor's patches and follow Citrix's containment and remediation recommendations. Since this is an active exploitation scenario, immediate patching and review of appliance configurations are advised. No additional mitigation steps beyond the vendor's guidance are recommended at this time.