Citrix NetScaler zero-day CVE-2026-88771 exploited via Platypus C2, 50,277 instances exposed

October 2, 2026 at 04:25 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers are exploiting a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway appliances, tracked as CVE-2026-88771, using the publicly available Platypus command-and-control framework. Exploitation has been confirmed in the wild since September 21, 2026, with 50,277 exposed instances identified globally. The vulnerability carries a CVSS score of 9.5 and was added to the CISA Known Exploited Vulnerabilities catalog on September 27, 2026.

Key Facts

CVE-2026-88771 is a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway appliances with a CVSS score of 9.5.
The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on September 27, 2026.
Palo Alto Networks Cortex Xpanse identified 50,277 exposed NetScaler instances globally.
Exploitation has been confirmed in the wild since September 21, 2026, with US targeting observed as early as that date.
Citrix released patches in versions 14.1-73.37 and 13.1-64.23 to address the vulnerability.

Exploitation Chain

The attack begins with a three-stage command injection process documented by Unit 42 researchers. The initial stage uses a Base64-encoded dropper hidden within the User-Agent header. This payload interacts with poisoned log entries to trigger execution of a Perl script. The process bypasses authentication entirely, granting attackers access before the appliance verifies the connection.

Platypus C2 Framework

Platypus is a publicly available Go-based command-and-control framework used in these attacks. It uses mutual TLS for encrypted communication and mDNS for lateral detection within the network. The framework repurposes the appliance from a security gatekeeper into a staging ground for further intrusion. Persistence is maintained through PHP web shells disguised as CSS files, with Apache configuration files modified to survive reboots. The TENEX team observed these tactics targeting SAML authentication virtual servers in late September 2026.

Response and Mitigation

CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on September 27, 2026, mandating action for federal agencies. Administrators are advised to apply patches provided in Citrix NetScaler versions 14.1-73.37 and 13.1-64.23. The speed of weaponization suggests the window between disclosure and active exploitation is minimal.