Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware

A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware.

Tracked as CVE-2026-88771, the vulnerability stems from improper input validation and can allow an unauthenticated attacker to execute commands remotely.

Citrix gives it a CVSS 4.0 score of 9.5 and says exploitation does not require an optional feature to be enabled. The company has confirmed attacks against unpatched systems.

The activity puts internet-facing NetScaler systems at risk of more than a brief intrusion attempt. A web shell can give an attacker a way to return and run commands, while malware may provide another route to control the appliance.

NetScaler devices often sit at the edge of company networks and handle access to applications, making a compromise important to investigate even after a software update.

Researchers from Zscaler’s ThreatLabz team identified a staged exploitation chain involving log poisoning, command execution and attempts to place several web shells.

They also observed a FreeBSD x64 malware payload being delivered during the activity. Zscaler cautions that shared infrastructure does not prove the attacks came from the same group; the connection could reflect reused hosting or malware distribution services.

Hackers Exploit Critical Citrix NetScaler RCE Flaw

In the observed chain, attackers sent requests to common NetScaler web paths and placed a marker and encoded commands in the User-Agent field.

This allowed attacker-controlled content to be written into access logs. They then sent crafted authentication requests containing text made to resemble a NetScaler process failure.

The aim was to have a vulnerable diagnostic process later handle the poisoned log entry and run the appended commands.

This delayed method matters because the first request may not itself run the full payload. Instead, it prepares the log entry, while a later process may trigger the commands.

Researchers observed attempts to create files in appliance directories, enable PHP or Perl handling in web-server settings, and plant scripts that could run commands.

These observations show attempted activity, not proof that every targeted appliance was successfully compromised.

Zscaler also reported attempts to download a Rust-based FreeBSD binary to the appliance and run it. The observed download command named the file kw2-freebsd-x64-s11 and placed it at /var/kw2s11.

Researchers saw a burst of similar activity from at least 26 source IP addresses over roughly six to seven minutes. This indicates repeated attempts, but does not establish how many systems were affected.

The activity follows other reports of attackers abusing NetScaler flaws to establish access. Cybersecurity News has described related exploitation and web-shell activity in its coverage of recent NetScaler zero-days and web shells on exposed devices.

These reports concern related NetScaler threats, but do not mean every campaign used the same malware or operators.

Patching and response

Citrix’s security bulletin says affected customers should install a fixed release. Its initial listed builds included NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, or later releases in those branches.

Zscaler’s October 16 guidance lists later builds—14.1-73.46 and 13.1-64.29—or later. Administrators should consult the Citrix security bulletin and install an appropriate currently supported update.

Patching prevents further exploitation of the flaw, but it does not prove that an appliance is clean. Organizations should preserve logs and forensic data where possible, then review authentication and access logs for suspicious markers, shell syntax, unexpected downloads and unusual requests.

They should also check for unexpected web files, altered HTTP-server settings, unfamiliar processes and outbound connections initiated by the appliance. Zscaler advises checking configuration integrity and rotating credentials, tokens and certificates if compromise is confirmed.

Teams should investigate connected systems as well as the appliance itself. A compromised edge device may expose stored configuration information or provide a route into internal networks.

If suspicious activity is found, security teams should contain the device, preserve evidence, assess whether accounts or secrets were exposed, and follow their incident-response process. A patch is an essential first step, not a substitute for checking whether an attacker already gained access.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.