Key points
- Threat actors are actively exploiting CVE-2026-88771 and CVE-2026-88772 to gain remote code execution on Citrix NetScaler appliances.
- The campaign involves deploying a modified Platypus remote access tool disguised as system files to maintain persistent control.
- Citrix released emergency fixes and CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog shortly after disclosure.
Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances to establish persistent access on network edge devices. According to Cyber Security News, attackers are using these flaws to deploy a modified version of the Platypus remote administration framework. This activity targets internet-exposed appliances that often sit between corporate networks and the public internet, providing attackers with a strategic foothold for further intrusion into internal systems.
By the numbers
- CVSS score of 9.5 assigned to both CVE-2026-88771 and CVE-2026-88772 by security researchers.
- Two specific zero-day vulnerabilities identified in the current active exploitation campaign.
- Up to 24-hour delay possible before malicious payload execution occurs on compromised devices.
What the figures mean
The high severity scores reflect the ease with which unauthenticated attackers can execute arbitrary commands on vulnerable systems. According to Cyber Security News, CVE-2026-88771 is an improper input validation flaw that requires no user account or interaction. GBHackers reports that attackers exploit this by embedding shell commands in data that resembles crash messages from the NSPPE packet engine. These commands are later processed by a vulnerable error-handling script, allowing remote code execution.
CVE-2026-88772 involves a memory overflow in the NetScaler Packet Processing Engine related to DTLS. As noted by Cyber Security News, DTLS is enabled by default on NetScaler VPN virtual servers unless administrators explicitly disable it. This makes remote-access deployments particularly susceptible. Attackers exploit this by sending malformed DTLS handshake fragments that overflow fixed-size buffers, leading to remote code execution or denial-of-service conditions.
What should you do?
Managed service providers must immediately verify if their clients’ NetScaler ADC and Gateway appliances are running affected versions. According to Citrix, emergency updates are available for these specific vulnerabilities. Administrators should apply these patches as soon as possible to close the initial attack vector. It is critical to remember that patching stops further exploitation of the flaw but does not remove existing backdoors or stolen credentials.
Operational impact
Security teams must coordinate with infrastructure managers to audit all edge appliances for signs of compromise. Incident response groups should review logs for unusual curl commands or unexpected ELF binaries in standard directories. Communication with clients requires clarity on the difference between patching the vulnerability and remediating an active breach. Procurement and risk teams need to assess whether current monitoring tools can detect delayed payload execution. Internal stakeholders must understand that residual threats may persist even after updates are applied.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: Citrix
- Apply the emergency updates provided by Citrix for CVE-2026-88771 and CVE-2026-88772 to all exposed NetScaler ADC and Gateway appliances.
- Scan appliance file systems for suspicious binaries disguised as Perl scripts or other legitimate files, particularly in /var/tmp/ and /netscaler.local/.
- Review network logs for delayed command executions that may indicate the presence of the Platypus remote access tool or similar implants.
- Verify whether DTLS is enabled on VPN virtual servers and ensure configurations align with current security requirements while waiting for patches.
Step-by-step guide: Citrix NetScaler Mistakes That Leave Your Network Open
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the two CVE IDs associated with this Citrix NetScaler exploitation campaign?
The vulnerabilities are tracked as CVE-2026-88771 and CVE-2026-88772.
Does patching the NetScaler appliance remove the Platypus backdoor if it has already been installed?
No, patching stops further use of the vulnerability but does not automatically remove existing web shells, backdoors, or remote access implants.
Is user authentication required to exploit CVE-2026-88771?
No, CVE-2026-88771 allows unauthenticated remote attackers to run commands without requiring a valid user account.
