Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware

A critical vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being exploited to run commands on exposed appliances, install web shells and deliver malware.

Tracked as CVE-2026-88771, the flaw allows an unauthenticated attacker to execute commands remotely. Citrix disclosed it on September 27, 2026, and confirmed exploitation of appliances that had not been protected by an update.

The vulnerability is rated 9.8 under CVSS v3.1 and 9.5 under CVSS v4.0, according to the Zscaler ThreatLabz report. The activity is concerning because NetScaler devices often sit at the edge of company networks and handle remote access or application traffic.

A web shell can provide a way back into a compromised appliance, while a separate malware implant can give attackers another foothold.

The campaign also shows why applying a patch alone may not be enough: organizations need to check whether attackers already changed files, settings or system logs.

Researchers from Zscaler ThreatLabz identified a staged exploitation chain that used log poisoning, command execution, attempts to place web shells and delivery of a FreeBSD malware implant.

Their technical analysis of CVE-2026-88771 says the attackers first placed encoded content in web access logs, then sent crafted authentication requests designed to trigger a vulnerable diagnostic process.

Hackers Exploit Critical Citrix NetScaler RCE Flaw

In the observed activity, requests to common NetScaler web paths carried a distinctive “INDEX:” marker and encoded content in the User-Agent field.

These requests were intended to get attacker-controlled data written to access logs; the initial request did not itself run the full payload. Attackers then sent authentication requests containing text made to resemble a Packet Processing Engine failure message.

The vulnerable process, a Perl diagnostic script, later handled matching log entries. According to Zscaler, the script did not safely handle attacker-controlled characters in the forged message.

When the script processed a poisoned entry, appended commands could run with its privileges. This delayed method helps explain why a request that appears to be ordinary web or login traffic may be part of a larger attempt to compromise an appliance.

The observed payloads attempted to create web-accessible files, enable PHP or Perl handling in the web server, and install files named Nx_7508.php and Nx_7508.pl.

Researchers also saw attempts to download and run a 64-bit FreeBSD binary named kw2-freebsd-x64-s11. Zscaler reported that the download infrastructure had also appeared in activity targeting Magento and Adobe Commerce with CVE-2026-75650, known as StyleSmuggler.

That overlap is an investigative lead, not proof that the same threat actor carried out both campaigns. This is not the first time attackers have used NetScaler flaws to leave behind web shells.

Cyber Security News previously reported on web shells on hacked Citrix NetScalers and a separate campaign involving Citrix NetScaler zero-days and malware.

These earlier reports are useful context, but they concern different incidents and should not be treated as evidence that the same operators are responsible.

What organizations should do

Citrix’s fixed builds listed in the Zscaler report are NetScaler ADC and Gateway 14.1-73.46 or later, and 13.1-64.29 or later. The report also lists 14.1-73.46 FIPS or later for 14.1-FIPS, and 13.1.37.283 or later for 13.1-FIPS and 13.1-NDcPP.

Administrators should verify the correct build for their product and upgrade promptly. Before updating, preserve relevant evidence where possible, including remote syslog data, technical support bundles and available core dumps.

Then review authentication and web access logs for suspicious “INDEX:” User-Agent values, forged “pitboss PPE” failure messages, unexpected requests to the paths listed below, and appliance-initiated connections to unfamiliar hosts.

Also inspect for unapproved web files, changed web-server settings and suspicious processes. If compromise is suspected, isolate the appliance while preserving evidence and rotate credentials, tokens and certificates it could access.

Patching prevents further exploitation of the flaw, but does not by itself remove an existing web shell or implant. Related coverage of another critical NetScaler flaw and previous NetScaler exploitation can help teams compare the current activity with earlier disclosures.

The weaknesses and campaigns differ, so responders should use the indicators below for this incident and check the relevant vendor guidance for each flaw.

Indicators of compromise (IoCs):-

Type	Indicator	Context

Type	Indicator	Context
Source IP	45.153.212[.]101	Reported source address
Source IP	46.233.40[.]20	Reported source address
Source IP	46.236.167[.]143	Reported source address
Source IP	46.33.33[.]95	Reported source address
Source IP	49.150.197[.]119	Reported source address
Source IP	78.190.152[.]64	Reported source address
Source IP	81.10.79[.]197	Reported source address
Source IP	82.167.14[.]7	Reported source address
Source IP	95.105.74[.]172	Reported source address
Source IP	100.38.125[.]66	Reported source address
Source IP	102.213.132[.]123	Reported source address
Source IP	102.222.146[.]45	Reported source address
Source IP	103.181.212[.]245	Reported source address
Source IP	103.197.249[.]161	Reported source address
Source IP	103.83.146[.]100	Reported source address
Source IP	111.92.128[.]89	Reported source address
Source IP	114.145.49[.]215	Reported source address
Source IP	120.244.160[.]182	Reported source address
Source IP	125.62.88[.]26	Reported source address
Source IP	130.12.182[.]7	Reported source address
Source IP	154.183.158[.]198	Reported source address
Source IP	154.241.254[.]9	Reported source address
Source IP	174.60.63[.]37	Reported source address
Source IP	177.52.203[.]23	Reported source address
Source IP	183.63.88[.]227	Reported source address
Source IP	190.117.56[.]56	Reported source address
Source IP	195.62.37[.]119	Reported source address
Source IP	207.48.184[.]10	Reported source address
Download server	209.141.43[.]95	Server linked to the FreeBSD payload download
Downloaded file	kw2-freebsd-x64-s11	FreeBSD x64 implant filename
File path	/var/kw2s11	Reported malware destination path
Web shell / file names	Nx_7508.php, Nx_7508.pl	Names used in observed deployment attempts
Fingerprint file	Nx_7508.html	Name used in observed appliance fingerprinting
User-Agent marker	INDEX:	Marker associated with staged content in access logs
Authentication log marker	pitboss PPE	Forged failure text observed in crafted requests
HTTP path	/logon/LogonPoint/tmindex.html	Observed request path
HTTP path	/logon/LogonPoint/index.html	Observed request path
HTTP path	/vpn/index.html	Observed request path
HTTP path	/logon/tmindex.html	Observed request path
Authentication path	/nf/auth/doAuthentication.do	Observed request path
Authentication path	/cgi/login	Observed request path

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.