NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

Attacks against Citrix NetScaler ADC and Gateway appliances have surged from quiet, targeted zero-day abuse into indiscriminate mass scanning, after a technical write-up and a working exploit for CVE-2026-88771 were made public. Citrix had already confirmed active exploitation when it released patches for eight flaws, including CVE-2026-88771 and CVE-2026-88772, both abused before disclosure, and issued a (admittedly imperfect) compromise-detection script. Researchers from GreyNoise, Lupovis, CERT-EU and Censys report attackers probing for admin access, planting webshells disguised as stylesheets, erasing logs, and exfiltrating data to a Hetzner-hosted server, with roughly 42,000 NetScaler instances still reachable online and fewer than 10% of them patched. One researcher says over 100 victim organizations have already been identified, each with a custom backdoor, pointing to likely espionage motives behind the initial wave of attacks. No public exploit exists yet for CVE-2026-88772, but defenders are urged to patch immediately and hunt for the indicators shared by the security community.