Critical Citrix NetScaler RCE Exploited to Deliver Web Shells and FreeBSD Malware

Attackers are exploiting CVE-2026-88771, a critical improper-input-validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway that permits unauthenticated remote command execution. The flaw carries CVSS scores of 9.8 under v3.1 and 9.5 under v4.0. Zscaler ThreatLabz observed a staged attack chain involving poisoned access logs, crafted authentication requests, appliance fingerprinting, attempted web-shell installation, and delivery of a Rust-based FreeBSD x64 malware payload. Researchers recorded a burst of attempts from at least 26 source IP addresses, but the evidence does not establish how many appliances were compromised or whether a single threat actor coordinated the activity.

Citrix has released fixed builds, and Zscaler’s October 16 guidance identifies later builds for affected release branches. Organizations should urgently upgrade affected appliances using current vendor guidance and investigate for prior exploitation rather than treating patching as remediation for an existing compromise. Security teams should preserve forensic evidence, isolate potentially compromised appliances, and hunt for web shells and malware; Gurucul’s report provides 28 IP indicators to support investigation. Patching does not remove previously installed implants or web shells.