Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

CVE-2026-88771

October 1, 2026 · The Hacker News · Severity: CRITICAL

This article details post-exploitation activity following the exploitation of CVE-2026-88771 in Citrix NetScaler devices. Attackers are using the vulnerability to create superuser accounts, map web shells to CSS-like URLs, and attempt to steal configuration data. LevelBlue observed consistent patterns in attacker-controlled authentication data and the use of second-stage payloads like a Python reverse shell script. 📌 **Analyst Note:** The active exploitation and the sophistication of post-exploitation payloads indicate that this vulnerability is being weaponized by advanced threat actors. Organizations using Citrix NetScaler should immediately apply patches and inspect for indicators of compromise such as the 'pitboss' and 'NSPPE

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler authentication events containing attacker-controlled usernames designed to weaponize CVE-2026-88771. CVE-2026-88771 (CVSS score: 9.5) is an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. The security flaw, along with CVE-2026-88772, was disclosed last week after reports that the Dutch National Cyber Security Centre (NCSC-NL) reportedly sent a pre-notification to organizations in the Netherlands that urged organizations to shut their appliances down, citing active exploitation. As of writing, there are currently no details about who is behind these efforts. "One of the most consistent characteristics across the identified events was attacker-controlled authentication data containing variations of the pitboss and NSPPE strings associated with exploitation of CVE-2026-88771," LevelBlue said . Other attempts have been observed using curl or wget to fetch additional payloads from external servers, or extract NetScaler configuration data - 64.94.85[.]67:443/update_c08937.pl 31.56.197[.]72:9090/lula 23.27.143[.]20:9000/main.py "Taken together, the observed commands demonstrate activity extending beyond basic vulnerability validation," LevelBlue said. "The attempts included payload retrieval and execution as well as collection and staging of NetScaler configuration data." Notable among the second-stage payloads is a Python script ("main.py") that's designed to establish a reverse shell to "45.141.21[.]130" over TCP port 443. It also searches for running processes associated with "/var/python/bin/customsnmpd" and forcefully terminates them by issuing a "kill -9" command. Another second-stage payload, "update_c08937.pl," is a Perl script with several post-exploitation capabilities - Modify "/flash/nsconfig/ns.conf" to create a local account named sec_monitor and assign it the superuser role. Archive the "/flash/nsconfig" directory into "/tmp/update_result_3567cs.tgz" and upload the resulting archive containing NetScaler configuration data to "64.94.85[.]67:443." The script then deletes the archive and erases itself to reduce the forensic footprint on disk. Change the permissions of "/bin/sh" to 6555 and deploy a PHP web shell at "/var/netscaler/logon/LogonPoint/.local_journal" for remote command execution and file upload and download. Modify "/etc/httpd.conf" to enable PHP execution and map the web shell to URLs resembling legitimate NetScaler CSS resources, corroborating activity observed by GreyNoise. "While some attempts used commands such as whoami to test command execution, others attempted to retrieve additional payloads, collect NetScaler configuration data, establish reverse shells, create privileged accounts, and deploy web shells," LevelBlue said. The disclosure comes a day after Mandiant Consulting and Google Threat Intelligence Group (GTIG) said dozens of organizations have been impacted by attacks exploiting CVE-2026-88772 to deliver PHP web shells, like WHIPSHOT, and a Python tunneler dubbed SLAPSHOT. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

Threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, CVE-2026-88771, to drop web shells and steal configuration data.
The exploitation involves attacker-controlled authentication data containing strings like 'pitboss' and 'NSPPE', and second-stage payloads include a Python script that establishes a reverse shell and searches for specific processes.
LevelBlue's analysis across multiple customer environments shows that attackers are using curl and wget to fetch additional payloads from external servers, indicating activity beyond basic vulnerability validation.