CVE-2026-88771: Citrix NetScaler — Mass Exploitation Enables Admin Access (September 2026)

CVE-2026-88771 — Citrix NetScaler ADC & Gateway

CVE-2026-88771 is a critical zero-day vulnerability in Citrix NetScaler ADC and Gateway appliances, enabling remote attackers to gain unauthorized administrator access. The flaw is under active, mass exploitation following the public release of a proof-of-concept exploit. No CVSS score is published yet, but exploitation has resulted in confirmed breaches at Microsoft, Amazon, and over 100 additional organizations.

Attack Vector

Attackers exploit internet-exposed, unpatched NetScaler devices by sending crafted POST requests to /nf/auth/doAuthentication.do with payloads containing the string pitboss PPE unexpectedly died NSPPE. Successful exploitation installs persistent webshell backdoors, allowing ongoing control. Outbound DNS lookups to domains ending in instances.httpworkbench.com and traffic to exfiltration server 138.199.200.90 have been observed. Initial intrusions were stealthy, but mass scanning and automated exploitation began rapidly after exploit code was published.

Who Is at Risk

All organizations running Citrix NetScaler ADC and Gateway appliances accessible from the internet are at high risk. Confirmed victims include Microsoft, Amazon, and over 100 unnamed entities, with evidence of unique webshell implants on compromised systems. Both enterprise and cloud environments are affected.

Patch & Mitigate

• Patch: Apply the latest Citrix security update for NetScaler ADC and Gateway immediately. Check Citrix advisories for the exact fixed version.
• Workaround: Temporarily restrict external access to NetScaler appliances if patching is not immediately possible.
• Detect: Review logs for POST requests to /nf/auth/doAuthentication.do containing pitboss PPE unexpectedly died NSPPE. Monitor for outbound DNS queries to instances.httpworkbench.com and connections to 138.199.200.90.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit vulnerable NetScaler appliances to gain a foothold.
• TA0003 — Persistence: Webshells are installed for ongoing access.
• TA0005 — Defense Evasion: Attackers use stealthy payloads and novel IOCs to avoid detection.

Source: https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771/