Citrix Net Scaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Summary: Threat actors are exploiting CVE-2026-88771, a pre-authentication command injection flaw in Citrix NetScaler ADC and NetScaler Gateway with a CVSS score of 9.5, to drop web shells and attempt theft of configuration data. LevelBlue's THOR team identified attacker-controlled authentication events containing variations of the pitboss and NSPPE strings, while eSentire reported at least four distinct activity clusters exploiting the flaw before and after public disclosure, with some post-disclosure activity within roughly 24 hours.
Key Takeaway: A CVSS 9.5 pre-authentication flaw on internet-facing appliances drew at least four separate activity clusters, and some actors were back within roughly 24 hours of disclosure - a timeline that leaves little room for a patch cycle measured in weeks.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-88771CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026