Citrix NetScaler zero-day exploited in active attacks to deploy web shells and steal credentials

Why This Matters

• NetScaler ADC and Gateway appliances sit at the network perimeter and are often trusted entry points for remote access, meaning a root-level compromise can hand attackers a foothold inside government and enterprise networks.
• The vulnerabilities were exploited before patches existed, and some administrators were advised to shut down affected appliances, underscoring the severity and the pressure on organisations to respond quickly.
• Attackers stole credentials and established persistence via web shells, raising the risk of follow-on intrusions, data theft or ransomware.

Background

Citrix NetScaler devices are widely used enterprise remote access and application delivery appliances. Such edge devices have repeatedly been prime targets for attackers, since compromising one can bypass perimeter defences. Security researchers have previously given unofficial names to exploited Citrix flaws, and the "PitScaler" label continues that pattern. The current incident stands out because independent firms observed exploitation before Citrix's public disclosure, a sign that defenders were operating without patch guidance for several days.

Key Perspectives

Mandiant and GreyNoise: Active exploitation has been underway since at least early September, with attackers deploying custom web shells and tunneling malware, and Mandiant assessing that organisations in government, financial services, education, legal and professional services across North America and Europe have been affected. Citrix: The company disclosed both vulnerabilities on Sunday, confirmed they had been exploited on unmitigated deployments and has released security updates, while also publishing support guidance for the flaws. watchTowr and other researchers: Verified that both zero-days were being exploited in the wild and highlighted that patches were still being prepared when the warnings emerged, prompting calls for organisations to check for indicators of compromise. Critics and sceptics: The window between private warnings and official patches left administrators with difficult choices, including shutting down critical appliances. There are concerns that organisations which have not yet applied updates or checked for the reported indicators remain exposed.

What to Watch

• Whether Citrix releases further technical detail on CVE-2026-88772 exploitation as Mandiant and others continue investigating.
• Adoption of the security updates, and whether additional organisations come forward as victims of the campaign.
• Whether the attackers behind the observed activity expand targeting to other regions, or whether other threat actors begin using the same exploits now that the flaws are public.