Exploitation of two Citrix NetScaler zero-days has escalated from quiet, targeted intrusions into broad internet-wide attacks after a proof of concept was published, Help Net Security reported Tuesday. Researchers estimate that fewer than one in ten exposed appliances has been patched.

What Happened

The flaws, CVE-2026-88771 and CVE-2026-88772, affect NetScaler ADC and NetScaler Gateway and can be exploited on unpatched devices running default configurations. CVE-2026-88771 is a pre-authentication flaw that lets a remote attacker execute commands. BleepingComputer reported that CVE-2026-88772 is a memory overflow that is reachable when DTLS is enabled, and that researchers have nicknamed the pair "PitScaler."

GreyNoise saw exploitation attempts on Sept. 24, before Citrix disclosed the bugs and released patches. Those early attackers tried to gain administrator access, hide web shells behind fake stylesheet files, erase their tracks in logs and restart servers. After watchTowr Labs published a proof of concept, sensors began recording live exploitation attempts within minutes, in opportunistic scans of the whole internet for unpatched appliances, according to Help Net Security.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

Censys counts roughly 42,000 internet-facing NetScaler hosts. About 13,549, or 32%, are in the United States and 5,678, or 13%, are in Germany; 4,254 sit on Microsoft infrastructure and 3,013 on Amazon's. Security researcher Kevin Beaumont estimates fewer than 10% are patched and says he is tracking more than 100 victim organizations.

The Intrusions

Google Threat Intelligence Group and Mandiant say targeted exploitation began in early September, The Register reported, hitting government agencies, financial institutions, education, legal and professional services organizations in North America and Europe. According to Mandiant's analysis cited by BleepingComputer, attackers sent malformed or fragmented record headers that corrupt heap memory in the NetScaler packet engine, giving them root access.

The intruders then planted custom PHP web shells disguised as .deb, .sig or .css files, altered web server configuration so those files would run as PHP, and in some cases returned fake 404 responses to hide them. They set the setuid bit on /bin/sh to keep root execution. Mandiant identified two new tools: WHIPSHOT, a PHP web shell that acts as an HTTP proxy for Base64-encoded commands, and SLAPSHOT, a Python TCP tunneler used to move into internal networks. The Register said attackers used that proxy for internal reconnaissance and credential theft, and Beaumont believes the initial goal was espionage.

Why It Matters

NetScaler gateways sit at the edge of corporate and government networks and handle remote access, so a root-level compromise gives attackers a foothold in front of everything else. Earlier NetScaler flaws, including the 2023 "Citrix Bleed" bug, led to widespread breaches and ransomware.

Detection is the hard part this time. Beaumont said each victim has a unique web shell that cannot be scanned for remotely, so outside researchers cannot produce a reliable list of compromised devices. Patching also does not remove an implant that is already there.

What to Watch

Help Net Security relayed hunting guidance: look for POST requests to /nf/auth/doAuthentication.do whose body contains the string "pitboss PPE unexpectedly died NSPPE," a sign of log poisoning, and DNS lookups ending in instances.httpworkbench.com. BleepingComputer listed further signs, including unauthorized PHP handlers in httpd.conf, unexpected NSPPE crashes and /tmp/.uxdport or /tmp/.uxdlock files linked to SLAPSHOT.

Organizations should install Citrix's updates, which are required to fix both flaws. Disabling DTLS, or blocking inbound UDP/443 upstream where DTLS is not needed, reduces exposure only to CVE-2026-88772. With a public exploit available and most devices still unpatched, the count of compromised organizations is likely to keep rising.