← Back to Feed
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
CVE-2026-88772CVE-2026-88771
September 29, 2026 · Google Cloud Security · Severity: CRITICAL
This article from Google Cloud Security describes an active exploitation campaign targeting Citrix NetScaler ADC and Gateway appliances using CVE-2026-88772 and CVE-2026-88771. The attackers deploy custom tools like WHIPSHOT and SLAPSHOT for stealthy command-and-control and internal network reconnaissance. Organizations across multiple critical sectors in North America and Europe have been impacted since early September 2026. 📌 **Analyst Note:** Security teams should prioritize patching both CVEs and monitor for signs of WHIPSHOT or SLAPSHOT usage, as the attackers are conducting manual internal reconnaissance and credential theft after gaining root access.
Key Takeaways
- Mandiant and Google Threat Intelligence observed active exploitation of CVE-2026-88772 in Citrix NetScaler ADC and Gateway, targeting organizations in government, finance, technology, education, and legal sectors.
- The threat actor used a custom PHP web shell named WHIPSHOT to disguise command-and-control traffic within HTTP headers, and a Python tunneler called SLAPSHOT to proxy into internal networks.
- Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine to establish root-level access for post-exploitation activities.
- The threat actor used a custom PHP web shell named WHIPSHOT to disguise command-and-control traffic within HTTP headers, and a Python tunneler called SLAPSHOT to proxy into internal networks.
- Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine to establish root-level access for post-exploitation activities.