Threats tagged 'citrix netscaler'

CVE-2026-88771 is a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway. Exploitation involves attacker-controlled usernames triggering command execution, payload retrieval, reverse shell deployment, web shell installation, privileged account creation, and attempted exfiltration of configuration data. Two second-stage payloads, main.py and update_c08937.pl, facilitate persistent access and data theft. Post-exploitation artifacts include creation of superuser accounts and system binary modifications. Public exploit code is available via Metasploit. No patch or remediation details are provided.

A malicious actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker attempted to establish persistence using a password-protected webshell and tried to escalate privileges by setting setuid and setgid bits on /bin/sh. The attack involved disguising a PHP webshell as a CSS file and manipulating web server aliases to evade detection. Although the targeted sensor was not compromised, the attack demonstrated sophisticated post-exploitation techniques for maintaining access and evading detection.