Citrix NetScaler ADC and Gateway appliances have been hit by two severe zero-day vulnerabilities—CVE-2026-88771 and CVE-2026-88772—that are currently under active exploitation. These flaws allow unauthenticated attackers to gain remote code execution access, putting NetScaler deployments everywhere at risk. Researchers discovered that the hackers are installing a modified version of the open-source Platypus remote access tool, outfitted with new modules for persistence and intrusion across enterprise edges.
What’s Going On
The first vulnerability, CVE-2026-88771, is a command-injection issue that responds to crafted authentication input; it affects NetScaler’s error-handling routines. Malicious strings inserted via usernames or other inputs can end up logged—but later processed by parts of NetScaler that misunderstand logs as commands, leaving exposed systems callable without legit credentials.
The second flaw, CVE-2026-88772, involves a DTLS memory overflow in VPN virtual servers when DTLS is enabled (default in many setups). Exploiting this allows attackers to either execute arbitrary code or crash services. Attacks leveraging both issues have been tied to Gateway and ADC devices.
How Platypus Is Being Used
After gaining access, attackers deploy Platypus—an open-source remote administration tool written in Go—but altered for FreeBSD, the underlying OS for NetScaler. The malware is masked: files that appear to be Perl scripts (e.g. with “.pl” extensions) are actually ELF binaries. Payloads arrive via a “curl | sh” style installation, and are hidden under familiar directories like /var/tmp, /netscaler.local/, or /var/core/.
The compromised version doesn’t just give remote terminal access—it includes modules for privilege escalation, persistence, self-updates, file I/O, plugin support, and even mutual TLS for command-and-control communication. Compromised hosts may also use a local mesh discovery system via mDNS to map other infected systems in the same network. Operator infrastructure has been traced back to domains including entretiensol[.]com and others.
Risk, Response, and Recommendations
Patching is urgent. Citrix has issued fixed versions—14.1-73.37 and 13.1-64.23 among them (including FIPS and NDcPP builds)—for both zero-days. These updates are essential to stop new exploitation.
Even after applying patches, systems should be treated as potentially compromised unless verified clean. Security teams must review logs—ns.log, sh.log, bash.log, httpaccess.log, httperror.log—for suspicious authentication strings, unexpected command-injection, use of “curl | sh,” and disguised binaries with “.pl” extensions. Outbound connections from NetScaler appliances to unfamiliar hosts are another red flag. For appliances in high-availability clusters, both nodes need full inspection. Credentials should be rotated, active sessions revoked.
The vulnerability report is based on investigations by Binary Defense, which spotted evidence of exploitation during firmware upgrades. One device only showed attempted attacks; another already had the Platypus implant in place. The campaign underscores how attackers are speeding up the move from initial access to long-term control of internet-facing infrastructure.
This incident adds to a growing trend: edge devices and appliances, long neglected in vulnerability prioritization, are increasingly favored as attackers’ front lines. The blend of zero-days with open-source malware adapted for obscure platforms like FreeBSD shows how threat actors are refining stealth and persistence. Observing where this leads will be crucial—but for many organizations, the immediate task is clear: patch, inspect, respond.
