The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated.
What started as stealthy targeting via zero-day exploits has now become widespread “spray and pray” exploitation, fueled by the publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771, which is remotely exploitable on unpatched devices with the default configuration.
From rumor to confirmed zero-day
Rumors about a NetScaler zero-day being exploited in the wild started late last week, and were confirmed when Citrix published a security advisory after the release of patches for eight critical and high-risk vulnerabilities.
Among those are CVE-2026-88771 and CVE-2026-88772, both both exploited as zero-days.
Citrix also provided a detection script customers could use to check for evidence of compromise, but acknowledged it “might fail to identify actual compromises” since attackers often change tactics, techniques, and procedures (TTPs) and infrastructure.
Since then, several cybersecurity firms and security researchers have shared information to help complete the picture.
What researchers are seeing
Threat-intelligence company GreyNoise, which runs a large-scale deception and observation network that collects and analyzes data on attacker behavior, says it detected a malicious cyber actor attempting zero-day exploitation against a Citrix NetScaler Gateway on September 24, more than three days before public disclosure.
“Though the adversary was unsuccessful in gaining a foothold on the targeted Swarm sensor, their post-exploitation playbook was revealed,” the firm noted.
The attacker tried to get admin access, hide a webshell (backdoor) behind a fake stylesheet address, cover their tracks in the logs, and restart the server.
Xavier Bellekens, CEO of cyber deception and threat intelligence firm Lupovis, told Help Net Security that their sensor network started recording live exploitation attempts against Citrix NetScaler within minutes of a PoC exploit for CVE-2026-88771 being released by watchTowr Labs.
The attempts they captured were opportunistic, aimed at scanning the whole internet for exposed, unpatched appliances. “If you run NetScaler and you haven’t patched, assume you are already being probed,” he added.
The technique used by attackers involves log poisoning, and the collected data is exfiltrated to a Hetzner server (138.199.200.90).
His advice to organizations is to hunt for POST /nf/auth/doAuthentication.do requests whose body contains pitboss PPE unexpectedly died NSPPE, and to watch DNS for outbound lookups ending in instances.httpworkbench.com, which indicates a host in their estate has already been hit.
CERT-EU also posted technical details and threat-hunting advice and pointers for organizations, informed by the investigation it started after hearing rumors of exploitation.
A large pool of potential targets
Censys, the firm running an internet-scanning platform of the same name, says that it currently detects around 42,000 internet-facing hosts running NetScaler ADC or NetScaler Gateway, though it cannot “see” whether they are vulnerable to attack or have been compromised.
“The United States accounts for 13,549 hosts (32%), followed by Germany at 5,678 (13%), then the Netherlands, United Kingdom, and Switzerland at roughly 4% each,” the firm says.
“Microsoft hosts 4,254 (10%) and Amazon 3,013 (7%), consistent with NetScaler VPX virtual appliances deployed in public cloud. More than three quarters of hosts sit outside the ten largest networks, spread across enterprise and telecom address space.”
Security researcher Kevin Beaumont said today that he has done some firmware-version scanning and that fewer than 10% of exposed hosts are currently patched.
He also shared that he is tracking over 100 victim organizations and that “each one has a unique webshell which can’t be scanned for remotely unless you’re the attacker.” The initial attackers’ goal, he believes, is espionage.
There is currently no public PoC for CVE-2026-88772, the other vulnerability exploited by the initial attackers.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
