Cybersecurity
Attackers exploit NetScaler flaw, deploy WHIPSHOT and SLAPSHOT
Researchers said unknown attackers used newly patched Citrix NetScaler flaws in September 2026 to gain root access on appliances, deploy WHIPSHOT and SLAPSHOT, and reach internal networks at dozens of organisations.
- Mandiant Consulting and Google Threat Intelligence Group said they observed exploitation of CVE-2026-88772 and CVE-2026-88771 in September 2026 against organisations in North America and Europe.
- Charles Carmakal said the intrusions had affected dozens of organisations across government, finance, technology, education, and legal and professional services.
- Google said CVE-2026-88772 bypassed authentication, stopped the NetScaler Packet Processing Engine, and allowed root-level access on the underlying FreeBSD platform.
- Google and watchTowr Labs said the attackers used web shells and the tools WHIPSHOT and SLAPSHOT to run commands, proxy traffic, and reach internal networks.
- Censys said there were 42,735 hosts and 323,527 web properties running NetScaler ADC or NetScaler Gateway as of 28 September 2026.
In September 2026, Mandiant Consulting and Google Threat Intelligence Group saw attacks against Citrix NetScaler ADC and NetScaler Gateway appliances in North America and Europe. Charles Carmakal said dozens of organisations had been affected, across government, finance, technology, education, and legal and professional services.
Google said exploitation of CVE-2026-88772 bypassed authentication and caused the NetScaler Packet Processing Engine to terminate, which led to root-level access on the underlying FreeBSD platform. watchTowr Labs described the flaw as a DTLS memory overflow in NSPPE.
After entry, the operators changed httpd.conf, used installer web shells, and placed PHP shells under paths such as /netscaler/gui/vpn/scripts/linux. Google said the shells were disguised as .deb and .sig files, and that WHIPSHOT extracted Base64 commands from HTTP headers and returned the results.
Google said SLAPSHOT, a Python tunnel, accepted commands from WHIPSHOT and forwarded TCP traffic to internal hosts for reconnaissance and credential theft. GreyNoise said exploitation of CVE-2026-88771 rose on 28 September 2026, CERT-EU described a separate variant using Base64 in the User-Agent header, and Censys counted 42,735 hosts and 323,527 web properties running NetScaler ADC or NetScaler Gateway.
Named in this story
People
- Charles Carmakal
- warned that dozens of organisations had been affected
Companies
- issued technical details through its security reporting
- watchTowr Labs
- described CVE-2026-88772 as a DTLS memory overflow
- GreyNoise
- reported additional exploitation activity tied to CVE-2026-88771
- Censys
- counted NetScaler hosts and web properties on 28 September 2026
Organisations
- Mandiant Consulting
- observed the exploitation with Google Threat Intelligence Group
- Google Threat Intelligence Group (GTIG)
- tracked the campaign and described the attack chain
Governments and agencies
- CERT-EU
- issued an alert on a separate exploitation pattern
Products and systems
- Citrix NetScaler ADC
- one of the targeted appliance products
- Citrix NetScaler Gateway
- one of the targeted appliance products
- NetScaler Packet Processing Engine (NSPPE)
- the component whose failure enabled root access
- WHIPSHOT
- a PHP web shell used after compromise
- SLAPSHOT
- a Python tunneller used after compromise
- FreeBSD
- the underlying platform on which root-level access was obtained
How the source tells it
The article kept a technical incident-reporting register, but it leaned into alarm and urgency through scale language, near-term warnings and repeated emphasis on new tooling.
- alarm loaded security language around root access, credential theft and exploitation
- urgency warnings about near-term follow-on attacks and same-day surges
- novelty repeated emphasis on newly patched flaws and previously unreported tools