Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

According to reporting from The Hacker News, unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances. The exploitation activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, targeted organizations in North America and Europe across government, financial services, technology, education, and legal and professional services sectors.

The actors leveraged the vulnerability to gain root access on affected appliances and deploy WHIPSHOT and SLAPSHOT malware. The source summary indicates the vulnerability was recently patched, though specific CVE identifiers, patch versions, and detailed exploitation methods were not provided in the excerpt. The full scope of impacted systems and the precise vulnerability details remain subject to verification through official Citrix advisories and security advisories.