Threat Overview: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Being Exploited in Production Environments (Updated September 30)
Two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems are being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated command injection, while CVE-2026-88772 is a DTLS memory overflow flaw enabling RCE or DoS attacks. Threat actors deployed webshells through these vulnerabilities to establish initial access and persistence. The CVE-2026-88771 exploitation involves a three-stage command injection chain poisoning log files, while CVE-2026-88772 exploitation drops .deb webshell files. Attackers used PHP webshells with RC4 encryption for command and control communications, targeting custom directories within NetScaler Gateway interfaces. Cortex Xpanse identified over 50,000 potentially vulnerable exposed instances.
Pulse ID: 6ac9eef4bcc05a59cd402770
Pulse Link: https://otx.alienvault.com/pulse/6ac9eef4bcc05a59cd402770
Pulse Author: AlienVault
Created: 2026-10-10 07:53:24
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CVE202688771 #CVE202688772 #NetScaler #DoS #OTX #AlienVault
