Critical NetScaler Vulnerabilities Exploited for Remote Code Execution
ID: da8644a9-064b-53ca-b6ce-fef962a26d2a
STIX ID: report--da8644a9-064b-53ca-b6ce-fef962a26d2a
Feed Name: ThreatCluster
Threat Score
Attackers are actively exploiting two critical Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to achieve unauthenticated RCE; weaponization since September 2026 includes deployment of PHP web shells and the Go-based Platypus C2 to maintain persistence, with over 50,000 exposed appliances worldwide affecting government and finance sectors despite available patches.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.