Google Details Active Citrix NetScaler Exploitation, Web Shells and Internal Network Tunnelling

Mandiant said it identified in-the-wild exploitation of CVE-2026-88772, while Citrix disclosures indicate that attackers are also exploiting CVE-2026-88771. The campaign has been ongoing since at least early September, with evidence involving organisations in North America and Europe across government, financial services, technology, education, and legal and professional services.

The investigation provides more than vulnerability details. It describes how attackers moved from initial access to persistence, command execution and internal network access using custom malware.

Mandiant identified a PHP web shell called WHIPSHOT and a Python-based tunnelling tool called SLAPSHOT. In at least one observed intrusion, SLAPSHOT was used to route traffic into the victim's internal network for reconnaissance and credential theft.

Two NetScaler Zero-Days Under Active Exploitation

The campaign centres on two newly addressed NetScaler vulnerabilities.

CVE-2026-88772 is the vulnerability that GTIG directly investigated. Mandiant says exploitation can bypass authentication and cause an unhandled termination of the NetScaler Packet Processing Engine, or NSPPE, providing initial root-level access.

The investigation indicates that exploitation occurs during the pre-authentication cryptographic handshake when the NSPPE processes inbound DTLS records. GTIG said it did not possess exploit code, but frontline telemetry suggested specially malformed or fragmented record headers could cause heap memory corruption and divert execution.

The second vulnerability, CVE-2026-88771, is also being actively exploited according to vendor disclosures cited by Mandiant. The Google report focuses its technical investigation primarily on CVE-2026-88772 and the post-exploitation activity observed on compromised appliances.

How Attackers Established Initial Access

According to Mandiant, the exploitation begins before authentication.

The NSPPE processes DTLS record structures during the cryptographic handshake. GTIG's telemetry analysis suggests that malformed or fragmented record headers can trigger heap memory boundary corruption. Successful exploitation was associated with NSPPE termination and SSL handshake failure messages in appliance logs.

Two specific log patterns highlighted by Mandiant include an SSL handshake failure associated with DTLSv1.0 and an NSPPE process termination recorded by the system and watchdog components.

These events do not, by themselves, establish that an appliance has been compromised. However, Mandiant includes them among the telemetry that defenders can investigate as part of a broader hunting process.

Web Shells Turn NetScaler Into a Persistent Platform

After gaining access, attackers deployed lightweight PHP web shells.

Mandiant observed modifications to /etc/httpd.conf that caused normally non-script file extensions to be treated as executable PHP. In one observed technique, .deb files were registered as PHP scripts and staged in a NetScaler script directory.

Another technique used .sig files and web-server aliases. Requests that appeared to target .ico image files could instead be mapped to corresponding .sig files containing PHP web shells.

This approach allowed malicious functionality to be hidden behind file types and paths that could appear less suspicious during routine investigation.

Mandiant also observed HTTP 404 responses associated with unusual processing times and response sizes, as well as subsequent attempts to access missing .sig files.

Root-Level Persistence Through SUID

The campaign also involved modification of the /bin/sh executable's permissions.

Mandiant observed the command used to set the SUID bit on /bin/sh. This allowed subsequent web-server requests to execute with elevated privileges. In some cases, the installer also restarted the web service or rebooted the NetScaler appliance after modifying its configuration.

This matters because gaining initial access and maintaining access are separate stages of an intrusion.

The attackers were not simply attempting to execute a command once. The observed tooling modified web-server configuration and system permissions to establish mechanisms that could survive normal service activity and support continued access.

WHIPSHOT Provides Command Execution

Mandiant named one of the observed PHP web shells WHIPSHOT.

The malware can receive Base64-encoded command data through native NetScaler HTTP headers. The report identifies headers including HTTP_NSC_LDAP and HTTP_NSC_CLIENTTYPE in different observed web-shell variants.

Some variants also attempted to conceal their activity by returning HTTP 404 responses.

Mandiant recovered several lightweight PHP web shells, with filenames varying across victims. Some observed samples used variations of the nginstaller naming pattern.

SLAPSHOT Extends Access Into Internal Networks

The second major component identified by Mandiant is SLAPSHOT, a Python-based TCP tunnelling tool.

Rather than functioning only as a local backdoor, SLAPSHOT can act as an internal network bridge. It accepts commands through WHIPSHOT and forwards TCP traffic to internal hosts. Its protocol supports actions for opening connections, pushing and pulling data, exchanging information, closing sessions and checking connectivity.

In at least one intrusion, Mandiant observed the threat actor using this proxy to manually conduct internal reconnaissance and credential theft.

This represents an important transition in the attack chain. The compromised NetScaler appliance becomes a point from which an attacker can interact with systems that may not be directly exposed to the internet.

What Defenders Should Hunt For

Mandiant provides several hunting strategies for organisations investigating possible compromise.

One important area is the NetScaler Apache configuration. Defenders should inspect /etc/httpd.conf for unexpected PHP handlers, MIME-type registrations and AliasMatch directives that redirect web paths towards script directories.

Investigators should also examine relevant NetScaler directories for unexpected files. Mandiant notes that legitimate client deliverables in these locations are normally compiled binaries or archives, while ASCII text or PHP markers can indicate anomalous content.

Runtime investigation can also look for:

• The SUID bit set on /bin/sh

• /tmp/.uxdport

• /tmp/.uxdlock

• Unexpected Python processes launched through nohup

• Base64-encoded payload execution

• Unexpected changes under /nsconfig/

• Suspicious web requests involving /vpn/media/ and /vpn/scripts/

• Unusual outbound connections originating from NetScaler appliances

Mandiant also published network and file indicators associated with the observed activity, including UDP/443 traffic using DTLS, specific HTTP headers, URI paths and SLAPSHOT artefacts.

Patching and Containment Guidance

Mandiant recommends organisations apply the latest Citrix builds addressing the vulnerabilities.

For the deployment tracks identified in its report, the recommended fixed releases include:

• NetScaler 14.1: 14.1-73.37 and later

• NetScaler 13.1: 13.1-64.23 and later

• Additional patched builds are available for relevant FIPS and NDcPP deployments.

Organisations that suspect compromise should treat remediation as more than a software upgrade.

Mandiant recommends isolating confirmed or suspected appliances, assessing both nodes independently in high-availability deployments and temporarily halting HA synchronisation when appropriate. This is intended to prevent malicious configuration changes from being replicated to another node.

The guidance also covers restricting outbound connectivity and reviewing network isolation for virtual NetScaler deployments.

Temporary Controls When Immediate Patching Is Not Possible

Mandiant describes targeted compensating controls for organisations that cannot immediately patch.

For CVE-2026-88772, these include disabling DTLS where operationally feasible and restricting inbound UDP/443 upstream when DTLS is not required.

Mandiant specifically warns that these controls apply to CVE-2026-88772 and should not be relied upon to mitigate CVE-2026-88771. Installing a fixed NetScaler build remains necessary to address both vulnerabilities.

Organisations should also consider upstream IP allow-listing where operationally appropriate and preserve virtual appliance state for forensic investigation before rebooting where possible.

Credential Rotation Is Part of the Response

A compromised NetScaler appliance can potentially expose credentials and session information.

Mandiant therefore recommends revoking active administrative, Gateway and VPN sessions and rotating relevant appliance and integration credentials after successful patching.

The guidance includes NetScaler administrator credentials, local accounts, SSH keys, TLS certificates and private keys, as well as LDAP, RADIUS, TACACS, SNMP and NITRO/API credentials.

Downstream Citrix infrastructure should also be reviewed for evidence of lateral movement.

Detection Needs Broader Network Visibility

The investigation highlights why monitoring only traditional endpoint telemetry may not be sufficient for internet-facing infrastructure.

Mandiant recommends ensuring NetScaler audit logs and relevant FreeBSD system logs are available to security monitoring systems. It also recommends correlating network, appliance, file-system and identity activity.

The report includes YARA rules for detecting WHIPSHOT, SLAPSHOT, suspicious NetScaler PHP configuration, command headers and persistence activity. Google Security Operations customers will also receive related detection rules through the Mandiant Frontline Threats rule pack.

What This Campaign Shows About Edge Device Security

The campaign highlights a broader industry shift toward attackers targeting internet-facing infrastructure as an entry point into enterprise environments.

NetScaler ADC and Gateway appliances can sit between the public internet and internal systems. As Mandiant notes, edge devices can be attractive targets because they are internet exposed, may fall outside traditional endpoint detection coverage and can process or store credentials useful for further access.

For enterprises, this means vulnerability management should extend beyond conventional servers and employee endpoints. Internet-facing gateways, VPN infrastructure, application delivery controllers and other network appliances require their own patching, logging, monitoring and incident-response procedures.

The campaign also demonstrates why patching alone may not be enough after confirmed exploitation. Once an attacker has established persistence, defenders need to investigate the appliance, review connected systems, terminate potentially compromised sessions, rotate credentials and search for lateral movement.

Key Takeaways

1. CVE-2026-88772 is being actively exploited against Citrix NetScaler ADC and Gateway appliances.

2. CVE-2026-88771 is also being actively exploited, according to vendor disclosures cited by Mandiant.

3. Mandiant observed WHIPSHOT PHP web shells being used for command execution and persistence.

4. SLAPSHOT provides TCP tunnelling into internal networks.

5. Attackers modified web-server configuration and /bin/sh permissions to maintain elevated access.

6. Defenders should investigate configuration files, system logs, web-shell artefacts, processes and outbound network activity.

7. Mandiant recommends upgrading to fixed NetScaler builds and applying additional containment measures where compromise is suspected.

Original Analysis

The most significant defensive lesson is the progression from edge-device exploitation to internal network access. The NetScaler appliance is not merely the initial target in the observed activity. Once compromised, it can become a platform for persistence, command execution and network tunnelling.

The development reflects growing demand for security teams to treat network appliances as part of the organisation's monitored computing environment rather than as isolated infrastructure.