Threats tagged 'web-shell'

CVE-2026-88771 is a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway. Exploitation involves attacker-controlled usernames triggering command execution, payload retrieval, reverse shell deployment, web shell installation, privileged account creation, and attempted exfiltration of configuration data. Two second-stage payloads, main.py and update_c08937.pl, facilitate persistent access and data theft. Post-exploitation artifacts include creation of superuser accounts and system binary modifications. Public exploit code is available via Metasploit. No patch or remediation details are provided.