Threat Brief: Net Scaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Summary: Unit 42 reports that Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both rated CVSS v4.0 9.5, and that threat actors exploited them in the wild to deliver web shells and establish initial access and persistence. As of Sept. 27, 2026, Cortex Xpanse identified 50,277 exposed instances potentially vulnerable to these CVEs, with the earliest observed activity on Aug. 21, 2026 from hosts at 104.248.244[.]66 and 77.83.199[.]39.
What's compelling: The recovered nsg64.deb web shell gives remote command execution, file exfiltration and upload, encrypts command-and-control with RC4, and escalates via the NetScaler SUID binary - and Unit 42 notes that patching will not remove access for attackers who already established persistence.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-88771CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026Unit 42 Vulnerability Research Team Discovers 23 New Vulnerabilities February 2019 Disclosures – Adobe and Microsoft Cyber Risks ·Defending Against Active Exploitation of Citrix Net Scaler ADC and Gateway Appliances Cyber Risks · Sep 29, 2026