By Mayura Kathir
Publication Date: 2026-10-08 07:00:00
Attackers are exploiting CVE-2026-88771, a critical pre-authentication command-injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to deploy reverse shells, create privileged accounts, and establish persistent access.
LevelBlue’s Threat Hunt Operations & Research (THOR) team identified malicious authentication events across multiple customer environments, documenting activity extending beyond vulnerability testing into payload execution and configuration theft attempts.
LevelBlue’s September 30 investigation links attacker-controlled usernames to commands that retrieve malware, stage sensitive appliance configuration, and modify legitimate components.
Its earlier advisory assigns the vulnerability a CVSS score of 9.5 and reports that Citrix released patches on September 27.
Observed authentication data repeatedly contained pitboss, NSPPE, and “unexpectedly died” alongside injected shell commands.
Some attempts invoked whoami to validate…
