By Tushar Subhra Dutta
Publication Date: 2026-10-23 07:50:00
A critical vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being exploited to run commands on exposed appliances, install web shells and deliver malware.
Tracked as CVE-2026-88771, the flaw allows an unauthenticated attacker to execute commands remotely. Citrix disclosed it on September 27, 2026, and confirmed exploitation of appliances that had not been protected by an update.
The vulnerability is rated 9.8 under CVSS v3.1 and 9.5 under CVSS v4.0, according to the Zscaler ThreatLabz report. The activity is concerning because NetScaler devices often sit at the edge of company networks and handle remote access or application traffic.
A web shell can provide a way back into a compromised appliance, while a separate malware implant can give attackers another foothold.
The campaign also shows why applying a patch alone may not be enough: organizations need to check whether attackers already changed files, settings or system logs.