Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Mandiant and Google's Threat Intelligence Group report that unidentified attackers are actively exploiting a recently fixed vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances, hitting government, financial, tech, education and legal organizations across North America and Europe since September 2026. The flaw, CVE-2026-88772 (CVSS 9.5), is a memory overflow in how the NSPPE component handles DTLS protocol records, letting attackers skip authentication and crash the packet engine to seize root-level control of the FreeBSD-based appliance. Successful compromise leads to deployment of a new PHP web shell called WHIPSHOT, which hides Base64-encoded commands inside HTTP headers, alongside a Python tunneling tool named SLAPSHOT that proxies traffic into internal networks for reconnaissance and credential theft, with both tools disguised as .deb or .sig files and configured to self-delete after inactivity. GreyNoise separately reported a sharp jump in mass exploitation of CVE-2026-88771 and CVE-2026-88772 by multiple independent actors starting September 28, 2026, warning that administrators of internet-facing NetScaler gear should patch immediately given the scale of ongoing attacks.