Attackers Exploit Net Scaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Summary: Mandiant Consulting and Google Threat Intelligence Group observed unknown threat actors in September 2026 exploiting CVE-2026-88772, a CVSS 9.5 memory overflow in NetScaler's DTLS handling that bypasses authentication and corrupts the heap to gain root on the FreeBSD platform, targeting government, financial, technology, education, and legal organizations in North America and Europe. The attackers modify httpd.conf to run .deb and .sig files as PHP, deploying the WHIPSHOT web shell that hides Base64 commands in HTTP headers and the SLAPSHOT Python tunneler for internal reconnaissance and credential theft, while GreyNoise reported mass exploitation of CVE-2026-88771 beginning September 28, 2026.
Key Takeaway: Censys counted 42,735 NetScaler hosts and 323,527 web properties as of September 28, 2026, and GreyNoise described the activity moving from mass reconnaissance to 'full-on mass exploitation across a multitude of independent actors' deploying web shells for botnet recruitment and access brokering.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-88771CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026