Citrix NetScaler Flaw Exploited for Root Access, Malware Deployment

Threat actors are actively exploiting a newly patched security vulnerability, CVE-2026-88772, in Citrix NetScaler ADC and Gateway appliances. Attackers are gaining root-level access and deploying post-exploitation toolkits like WHIPSHOT and SLAPSHOT. Mandiant Consulting and Google Threat Intelligence Group have observed these attacks targeting government, financial services, technology, education, and legal sectors across North America and Europe, posing a significant cybersecurity risk.