Citrix NetScaler Zero-Day Under Active Attack: What Businesses Need to Know

Mandiant Consulting and the Google Threat Intelligence Group (GTIG) have identified active exploitation of a zero-day vulnerability, tracked as CVE-2026-88772, in Citrix NetScaler ADC and NetScaler Gateway appliances. The campaign has been running since at least early September. Organisations in North America and Europe across government, financial services, technology, education, and legal and professional services were likely affected. Vendor disclosures also indicate a second zero-day, CVE-2026-88771, is being exploited.

According to the researchers, the flaw lets attackers bypass authentication and crash a core packet processing component, which gives them root-level access to the appliance. Afterwards, the attackers used custom tools. One is a web shell called WHIPSHOT, which hides its command traffic inside ordinary web headers. Another is a Python tool called SLAPSHOT, which relays traffic into internal networks. In at least one intrusion, the attacker used this proxy to explore the internal network manually and steal credentials. Successful attacks left two log traces: an SSL handshake failure in the system log and a packet engine process termination in the appliance's system messages.

Citrix has published guidance on the newly addressed vulnerabilities and recommended updates, and Mandiant urges defenders to prioritise patching. Mandiant is also issuing containment and remediation guidance. This summary covers only the opening of the source article, so readers should consult the full Google Threat Intelligence post and Citrix documentation for complete details.