Citrix NetScaler Zero-Day in the Wild: Remote Code Execution, Web Shells and What to Do Now
A critical remote code execution flaw in Citrix NetScaler ADC and Gateway — tracked as CVE-2026-88771 — is being actively exploited to run commands on exposed appliances, install web shells and deliver malware. Observers report attackers using a staged technique that poisons logs, triggers a diagnostic process to execute embedded commands, and then attempts to persist via web shells or a FreeBSD x64 binary. With NetScaler devices frequently positioned at…