Anatomy of an Attack: NetScaler Exploitation, Hidden Web Shells, and Internal Pivots
ExtraHop, Monday, October 19th, 2026
ExtraHop examines NetScaler zero-day exploitation, hidden web shells and internal pivots tied to CVE-2026-88771 and CVE-2026-88772.
ExtraHop examines attacks on Citrix NetScaler ADC and Gateway appliances after Citrix disclosed eight vulnerabilities on September 27, 2026.
Attackers were already exploiting two of them, CVE-2026-88771 and CVE-2026-88772, as zero-days, with Unit 42 seeing exploitation from August 27.
Rapid7 confirmed compromises, and Google Threat Intelligence Group tracked others in North America and Europe.
ExtraHop describes how attackers planted hidden web shells and pivoted internally, and how network data reveals that activity.