Citrix NetScaler Root Command-Execution Flaw Exploited for C2 Agents and Web Shells

Attackers are exploiting CVE-2026-88771, a critical pre-authentication command-execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to deploy malicious agents, reverse shells, and persistent access mechanisms. Citrix disclosed confirmed zero-day exploitation and issued emergency updates on September 27, assigning the flaw a CVSS v4.0 score of 9.5. The vulnerability enables unauthenticated execution as root through malicious log entries processed by the admautoregd daemon. SOCRadar identified an exploitation framework dubbed NetScaler C2 that automates internet reconnaissance, version checks, exploitation, agent deployment, and operator commands. Reported indicators include C2 address 45.143.130[.]195 and agent path /tmp/.nsagent, with HTTP command polling and DNS callbacks. SOCRadar did not recover an active C2 instance or independently establish the number of compromised appliances; code artifacts suggest Chinese-speaking developers and AI assistance but do not establish actor attribution or state sponsorship.

LevelBlue separately observed malicious authentication events across multiple customer environments involving Python and Perl payloads designed to modify appliance components, create a superuser account, install a disguised PHP web shell, and attempt configuration theft. The observations do not confirm that every exploitation or exfiltration attempt succeeded, and failed authentication does not exclude successful command injection. Administrators should isolate suspected compromised appliances, install supported fixed releases, and investigate existing compromise by reviewing authentication records, unexpected files and privileged accounts, configuration access, and outbound traffic. Patching addresses the vulnerability but should not be assumed to remove previously installed persistence.