Hackers exploit Citrix NetScaler zero-day to deploy web shells

According to cybersecurity reporting, unidentified threat actors are actively exploiting a zero-day vulnerability identified as CVE-2026-88772 in Citrix NetScaler appliances. The exploitation chain allows remote code execution and grants root access to affected devices. Attackers have been observed deploying custom web shells and tunneling malware to maintain persistence and move laterally within compromised networks. The primary objective appears to be credential theft and the exfiltration of sensitive data from internal systems. The scope of affected organizations is reported to be global, targeting enterprises that rely on NetScaler for application delivery and load balancing. Citrix has published security advisories and released patches to address the vulnerability. Security teams are urged to apply the latest updates immediately and to monitor for indicators of compromise associated with the exploitation activity. The full extent of affected entities and specific threat actor attribution remain under investigation.