Overview
Attackers are exploiting two critical Citrix NetScaler zero-day vulnerabilities to deploy a modified remote access tool, demonstrating how quickly an exposed edge device can move from vulnerable gateway to persistent foothold. Tracked as CVE-2026-88771 and CVE-2026-88772, both vulnerabilities carry a CVSS score of 9.5 and affect Citrix NetScaler ADC and Gateway appliances. The vulnerabilities can enable remote code execution without requiring a valid user account. Citrix has released emergency fixes, while CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. The more concerning development, however, is what attackers are doing after exploitation.
The Gateway Has Become the Target
NetScaler appliances occupy a particularly sensitive position in enterprise architecture. They commonly provide application delivery, remote access and VPN functionality at the boundary between the public internet and internal infrastructure. Compromising such a device therefore provides more than access to a single server. Researchers from Binary Defense investigated two NetScaler devices during a customer’s upgrade process. One showed evidence of attempted exploitation, while the other contained a modified build of Platypus, an open-source remote administration framework written in Go. The attackers had adapted the tool for FreeBSD, the operating system used by NetScaler appliances, and disguised it as a Perl-related file. This is an important shift in the attack lifecycle: the vulnerability is being used to establish control, while the remote access implant provides the longer-term capability.
Exploitation Can Become Persistence
The deployment method observed by researchers included commands using curl piped directly into a shell to retrieve and launch the malicious tool. Files were placed in locations that could appear familiar on a NetScaler appliance, helping the implant blend into the system environment. The modified Platypus build reportedly included functionality for command execution, file access, persistence, cleanup and timestamp manipulation. It could also communicate with command-and-control infrastructure using mutual TLS and discover other compromised systems through a local peer-discovery mechanism. This demonstrates why the compromise of an edge appliance cannot be treated simply as a vulnerability-management event. Once arbitrary code execution has occurred, the question changes from “Has the vulnerability been patched?” to “What did the attacker leave behind?”
Two Vulnerabilities, Different Attack Paths
CVE-2026-88771 is an improper input-validation flaw that can allow an unauthenticated attacker to execute commands on the appliance. Researchers found that crafted authentication-related input could be written into NetScaler logs, with a vulnerable error-handling process subsequently executing the injected commands. The delayed execution aspect is particularly significant. Malicious input may initially appear to be an unusual authentication request, while the actual command execution happens later through a maintenance process. CVE-2026-88772 is a DTLS memory-overflow vulnerability affecting NetScaler VPN virtual servers where DTLS is enabled. Successful exploitation can potentially result in code execution or denial of service. Together, these vulnerabilities demonstrate how different weaknesses within the same edge platform can provide multiple opportunities for attackers.
Patching Does Not Remove an Implant
Citrix has identified fixed releases, including NetScaler versions 14.1-73.37 and 13.1-64.23, together with the corresponding FIPS and NDcPP releases. Applying the appropriate security update is essential, but it should not be considered sufficient where an appliance was exposed while vulnerable. Security teams need to investigate affected appliances for suspicious authentication activity, unexpected shell commands, unusual downloads and binaries masquerading as legitimate files. Outbound connections from NetScaler appliances should also be reviewed because an edge gateway initiating unexpected external communications can be an important indicator of compromise. High-availability deployments require particular attention. Investigating only one appliance can leave a compromised partner node available to maintain access.
Expert in the Cloud Insight
The most important lesson from the NetScaler Platypus campaign is that patching addresses the vulnerability, not necessarily the compromise. An attacker who gains command execution on a security gateway can potentially establish persistence, manipulate files, harvest information and create a remote management channel that survives beyond the original exploitation window. This is why critical edge infrastructure requires a different response model. Patch the vulnerability. Investigate the appliance. Rotate exposed credentials. Revoke active sessions. Validate both nodes. Then continue monitoring. A gateway positioned at the edge of the network is part of the security boundary — and once that boundary has been breached, restoring the software version alone does not automatically restore trust.
Leave a Reply