Citrix NetScaler zero-days reportedly used to deploy web shells and tunneling malware

Tunneling from a compromised appliance to internal devices

According to the report, attackers exploited the Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772. Mandiant linked activity involving CVE-2026-88772 to custom PHP web shells and two previously undocumented malware families, WHIPSHOT and SLAPSHOT.

The report says SLAPSHOT can tunnel connections between a compromised appliance and internal devices, while observed activity included reconnaissance and credential theft. Citrix reportedly confirmed that both flaws had been exploited on unmitigated deployments.

The supplied report describes activity beginning at least in early September and one observed attempted exploitation on September 24, before Citrix publicly disclosed the flaws. It does not provide a comparable prior rate or scope of compromise.

The newly reported operational detail is that exploitation of Citrix NetScaler flaws was allegedly used to install concealed web shells and tunneling malware, enabling root-level access and movement toward internal systems.

Mitigation coverage differs between the two flaws

The reported activity goes beyond exploitation of an internet-facing appliance: the described web shells and tunneling tool were intended to conceal attacker access and reach internal devices. The report also notes that mitigations for CVE-2026-88772 do not protect against the separately exploited CVE-2026-88771.