Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

LevelBlue's threat hunting team has uncovered active abuse of a critical pre-authentication command injection flaw in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 (CVSS 9.5), which lets unauthenticated attackers run arbitrary commands. Analysts found malicious authentication attempts across several customer environments containing strings tied to the exploit, along with follow-on activity fetching second-stage payloads via curl or wget from external servers. One Perl payload adds a hidden superuser account named sec_monitor to the device configuration, archives and exfiltrates NetScaler config data, then plants a PHP web shell disguised with URLs mimicking legitimate NetScaler CSS files before erasing its own traces. A separate Python payload opens a reverse shell over port 443 and kills a monitoring process to stay hidden. The findings follow recent disclosures that a related flaw, CVE-2026-88772, has already been exploited against dozens of organizations to deliver web shells and tunneling tools, underscoring the urgency for Citrix NetScaler customers to patch and hunt for compromise indicators.