Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data

Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration data.

The activity goes beyond simple testing, with malicious scripts designed to maintain access and send stolen files to attacker infrastructure. The flaw affects NetScaler ADC and NetScaler Gateway and allows command execution before authentication.

Citrix rates it 9.5 under CVSS 4.0 and says vulnerable default deployments are exposed without any extra feature enabled. Its confirmed NetScaler zero-day exploitation prompted emergency updates on September 27, 2026.

Researchers from LevelBlue’s Threat Hunt Operations & Research team identified malicious authentication events across multiple customer environments.

Their September 30 technical report describes Python and Perl payloads supporting reverse shells, privileged accounts, web shells, and attempted configuration theft. The findings do not establish that…