THE VPN GATEWAY IS UNDER ATTACK

Two Citrix NetScaler zero-days are being exploited and patching may not be enough

Your employees might be working from home.

Your customers might be connecting remotely.

Your systems might be sitting safely behind a VPN.

But what happens when the device providing that VPN becomes the target?

That is the situation security teams are dealing with right now.

Two critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild.

And attackers aren't simply trying to crash the devices.

In observed intrusions, attackers gained root-level access, installed web shells and used a tunneling tool to move deeper into internal networks.

This is why the story isn't simply:

“Patch your VPN.”

The bigger question is:

“Was your VPN already compromised before you patched it?”

🚨 MEET THE TWO ZERO-DAYS

The vulnerabilities are:

CVE-2026-88771

A remote-code-execution vulnerability caused by improper input validation.

The worrying part?

It affects NetScaler ADC and Gateway deployments in the default configuration.

No additional feature is required for the vulnerability to be present.

Citrix rates it CVSS 9.5 — Critical.

CVE-2026-88772

This is a memory-overflow vulnerability that can lead to remote code execution or denial of service.

It affects deployments where DTLS is enabled — and Citrix notes that DTLS is enabled by default on VPN virtual servers.

It is also rated CVSS 9.5 — Critical.

Citrix has confirmed exploitation of both vulnerabilities against unmitigated deployments.

🌐 WHY A VPN GATEWAY IS SUCH A BIG DEAL

A VPN gateway isn't just another computer sitting somewhere in the office.

It is an entry point into the organization's network.

Employees use it to connect.

Administrators use it.

Applications may depend on it.

Authentication systems may interact with it.

And once an attacker compromises an internet-facing gateway, they may have a position from which to investigate what lies behind it.

That's exactly why edge devices have become attractive targets.

Mandiant notes that appliances such as VPN gateways, firewalls and application-delivery controllers are exposed to the internet, often sit outside traditional endpoint-detection coverage and can process credentials useful for moving deeper into networks.

💀 THIS WASN'T JUST A CRASH

Mandiant's investigation found something much more serious.

In the observed exploitation of CVE-2026-88772, attackers were able to bypass authentication and obtain initial root-level access on the NetScaler appliance.

They then deployed custom malware.

One component was a PHP web shell called:

WHIPSHOT

WHIPSHOT allowed attackers to interact with the compromised appliance while attempting to hide their activity inside normal-looking HTTP behavior.

Another tool was:

SLAPSHOT

SLAPSHOT acted as a network tunneling tool.

It allowed attackers to use the compromised NetScaler as a bridge into the victim's internal environment.

Mandiant observed this being used for:

Internal reconnaissance
Credential theft
Network access
Further investigation of the victim's environment

🕳️ THE ATTACKER DIDN'T NEED TO STAY AT THE FRONT DOOR

This is what makes the campaign particularly interesting.

Imagine your organization's network as a building.

The VPN gateway is the front entrance.

The attacker breaks through the entrance.

But instead of immediately attacking everything inside, they quietly install a hidden passage.

That passage allows them to explore.

Find valuable systems.

Look for credentials.

And potentially move further into the organization.

That's essentially what a tunneling capability like SLAPSHOT can provide.

The compromised edge appliance becomes more than a victim.

It becomes a launching point.

👻 THE WEB SHELL PROBLEM

Mandiant found attackers modifying NetScaler web-server configuration files to make unusual file extensions execute as PHP.

In some cases, web shells were disguised using extensions such as:

.deb

.sig

Rather than simply dropping an obvious file called:

malware.php

the attacker could make a seemingly ordinary-looking file behave like executable code.

Mandiant also observed techniques designed to disguise requests and interfere with traces of the malicious installation.

⚠️ PATCHING DOES NOT AUTOMATICALLY MEAN CLEAN

This is probably the most important lesson from this incident.

Suppose:

Monday:
Your NetScaler is vulnerable.

Tuesday:
An attacker compromises it.

Wednesday:
You install the security update.

Does that automatically mean the attacker is gone?

No.

If the attacker established persistence before the patch, updating the vulnerable software does not necessarily remove everything they already installed.

That's why security teams are being advised to investigate for signs of compromise as well as patch.

Mandiant specifically recommends examining configurations, logs, files, processes and other indicators of compromise on affected appliances.

🔍 WHAT SHOULD SECURITY TEAMS LOOK FOR?

Mandiant identified several useful investigation areas.

1. Unexpected web-server configuration changes

Review NetScaler configuration files for suspicious PHP handlers, aliases or unusual extensions being treated as executable scripts.

2. Strange files in VPN-related directories

Look for unexpected scripts or text files disguised as normal client components.

3. Suspicious log activity

Investigate unusual HTTP 404 responses, abnormal processing times and unexpected requests involving VPN media or script paths.

4. Strange processes

Look for unexpected Python processes, particularly those associated with tunneling activity.

5. Suspicious `/tmp/` artifacts

Mandiant identified files such as:

.uxdport

.uxdlock

as indicators associated with SLAPSHOT activity.

6. Unexpected permissions

Investigate suspicious changes to /bin/sh, including unauthorized SUID permissions.

These are investigation indicators for security teams, not instructions for exploiting the vulnerability.

🛡️ WHAT SHOULD ORGANIZATIONS DO NOW?

1. Identify every NetScaler appliance

Don't assume you have none.

Check:

Production
Disaster recovery
Remote offices
Virtual appliances
VPN infrastructure
Hybrid environments

2. Check your version

Citrix lists these fixed releases:

NetScaler 14.1:
14.1-73.37 and later

NetScaler 13.1:
13.1-64.23 and later

Specific fixed builds are also available for supported FIPS and NDcPP deployments.

3. Patch urgently

This is not a vulnerability to leave until the next routine maintenance window if you operate an affected internet-facing appliance.

Both flaws are already being exploited.

4. Hunt BEFORE declaring victory

If the appliance was exposed while vulnerable, investigate it.

Look for:

Web shells
Configuration changes
Unknown files
Suspicious processes
Unexpected outbound connections
Credential access
Unusual authentication activity

5. Rotate credentials if compromise is suspected

If an attacker obtained access to the appliance, assume that credentials and secrets stored or accessible through it may have been exposed.

Mandiant recommends considering rotation of NetScaler administrator credentials, SSH keys, certificates and connected integration credentials after successful remediation.

🇳🇬 WHY THIS MATTERS TO NIGERIAN ORGANIZATIONS

The technology may sound enterprise-level.

But the lesson isn't limited to multinational corporations.

Organizations in Nigeria increasingly depend on:

Remote workers
Cloud applications
VPNs
Online banking systems
Customer portals
Remote administration
Hybrid infrastructure
Third-party IT providers

A compromise of an edge device can potentially turn into something much larger than a single vulnerable appliance.

And that's why cybersecurity teams shouldn't only ask:

“Is our website secure?”

They also need to ask:

“What is sitting between the internet and our internal systems?”

🔥 THE BIGGER CYBERSECURITY LESSON

For years, security conversations focused heavily on endpoints.

Protect the laptop.

Protect the desktop.

Install antivirus.

Patch Windows.

But attackers increasingly look for something else:

THE EDGE.

The device sitting between your organization and the internet.

VPN gateways.

Firewalls.

Application delivery controllers.

Remote-access systems.

Network management appliances.

These systems can become extremely valuable targets because compromising one may provide access or visibility that a compromised employee laptop doesn't.

Mandiant says edge devices continue to be attractive targets precisely because of their internet exposure and their position at the boundary of internal networks.

🚨 THE QUESTION EVERY IT TEAM SHOULD ASK

Don't ask only:

“Have we patched NetScaler?”

Ask:

“Was this appliance ever exposed while vulnerable?”

Then ask:

“Have we checked for persistence?”

“Have we checked the logs?”

“Have we checked the configuration?”

“Have we checked credentials?”

“Have we checked what the appliance communicated with?”

Because there is a massive difference between:

PATCHED

and

CLEAN.

🧠 OSMALLAMINTECH TAKEAWAY

The Citrix NetScaler incident is another reminder that the most dangerous part of an organization isn't always the device employees are using.

Sometimes it's the gateway everyone trusts to let them in.

A VPN is supposed to provide secure access.

But when the gateway itself is compromised, that trusted doorway can become an attacker's foothold.

And now that these two vulnerabilities are being exploited in the wild, organizations using affected NetScaler deployments have two jobs:

PATCH.

INVESTIGATE.

Doing only one may leave an attacker with a path back inside.

💬 OSMALLAMINTECH QUESTION

Your organization discovers that its VPN gateway was vulnerable for three weeks.

Would you simply patch it...

or investigate first to find out whether someone was already inside?

What would your organization's incident-response plan do?

OSMALLAMINTECH

Cybersecurity Awareness | Threat Intelligence | Digital Resilience