Government authorities and security teams are racing to assess the fallout from a campaign aimed at critical flaws in Citrix NetScaler. Government agencies and critical infrastructure providers were targeted in a wave of attacks dating back more than a month in what may be targeted espionage. Security teams were first alerted over the weekend in a series of direct warnings from government security agencies, IT security vendors and others urging them to immediately disable their systems. In the days since, researchers say, the impact has been felt in dozens of organizations across multiple industries.

CVE-2026-88771 and CVE-2026-88772: Two critical flaws under active exploitation

Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway on Sunday. Two of those, tracked as CVE-2026-88771 and CVE-2026-88772, are confirmed to be under exploitation. Both carry a severity score of 9.5 out of 10.

CVE-2026-88771 is a remote code execution flaw tied to improper input validation. An attacker can run arbitrary commands on a target system without needing to authenticate. The flaw impacts all NetScaler ADC and NetScaler Gateway versions, even default configurations.

CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. Exploitation requires Datagram Transport Layer Security (DTLS) to be enabled on the NetScaler ADC or gateway. On VPN virtual servers, DTLS is enabled by default.

Citrix warns the vulnerabilities could enable remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction.

Sectors across North America and Europe hit by the campaign

Google Threat Intelligence Group (GTIG) and Mandiant Consulting identified dozens of affected organizations across North America and Europe, according to a LinkedIn post by Charles Carmakal, CTO at Mandiant. Targeted sectors include government, education, financial services, telecommunications, legal and professional services.

The intrusion activity has not been attributed to a known threat group, but GTIG and Mandiant believe the actors have state-nexus affiliations. The activity demonstrates advanced knowledge and sophistication.

Researchers at Arctic Wolf reported attacks targeting at least 78 organizations across the U.S., Canada and Europe. Industries hit include energy, healthcare, financial, local governments, media, education and professional services.

More than 20,000 Citrix NetScaler instances are exposed and potentially vulnerable, according to Shadowserver Foundation data.

Exploitation timeline extends back to August

Researchers at GTIG trace the threat activity to at least September 3. After exploiting CVE-2026-88772, hackers modified Apache configurations to process random file types including .deb, .sig and .ico as PHP files, Carmakal said.

Security firms discovered custom PHP webshells, including one called Whipshot, which conceals Base64-encoded command-and-control payloads inside native HTTP headers. A Python tunneler named Slapshot was also found, capable of reconnaissance and credential theft.

Palo Alto Networks researchers told Cybersecurity Dive they have traced activity back to August 21 and are continuing to investigate additional cases.

Security updates issued but patching alone may not clean infected systems

Citrix urged customers to apply immediate security upgrades. Required minimum versions include:

  • NetScaler ADC and NetScaler Gateway 14.1-73.37 and later releases
  • NetScaler ADC and NetScaler Gateway 13.1-64.23 and later
  • NetScaler ADC 14.1-FIPS and 14.1-73.37 FIPS and later 14.1-FIPS releases
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later 13.1 FIPS and 13.1 NDcPP releases

Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, noted that NetScaler often sits at the edge of network infrastructure in healthcare IT and OT environments, providing secure remote access and application delivery for clinicians and staff accessing electronic health records remotely.

Health-ISAC issued an urgent advisory to member organizations on Sunday. Some healthcare chief information security officers indicated they planned to disable connections until permanent fixes are available.

Researchers caution that patching will not necessarily resolve infections, particularly if attackers gained access before security updates were applied. Carmakal stated in a LinkedIn post that upgrading alone will not eradicate post-exploitation access or address stolen credentials.

Mitigation steps for teams unable to patch immediately

GTIG recommends that security teams isolate NetScaler from the broader network in cases of suspected compromise. Researchers note this procedure can cause significant business disruption.

As a temporary measure, DTLS can be disabled on internet-facing NetScaler Gateway servers. Inbound UDP/443 access, used to accelerate web traffic, can be blocked on affected servers.

Security teams should rotate credentials, revoke active sessions, and audit downstream Citrix infrastructure including StoreFront servers and Delivery Controllers. Reviewing Windows Event Logs for unusual logins or unexpected Remote Desktop Protocol use is also advised.