Citrix NetScaler zero-day exploited to gain root access

Mandiant and Google Threat Intelligence Group have documented the active exploitation of CVE-2026-88772, a pre-authentication vulnerability with a CVSS score of 9.5 affecting Citrix NetScaler ADC and Gateway devices. The flaw involves the handling of the DTLS protocol and enables memory corruption during the initial handshake, before the user is required to authenticate, paving the way for code execution and root access. Attackers deployed custom web shells named WHIPSHOT and SLAPSHOT against dozens of government, financial, technology, education, and legal organizations in North America and Europe. The activity dates back to at least early September and was initially attributed to advanced actors, likely state-sponsored; Citrix also reported the parallel exploitation of CVE-2026-88771. Organizations must immediately update their appliances, check for the presence of the tools described, and consider vulnerable Internet-exposed systems compromised, especially when DTLS was enabled.

Source: Help Net Security