Hackers Use Citrix NetScaler Zero-Days to Install Platypus Backdoor
Attackers exploit two critical unauthenticated flaws in Citrix NetScaler to deploy a modified remote access tool on edge appliances.
Key points
- Threat actors are actively exploiting CVE-2026-88771 and CVE-2026-88772 to gain remote code execution on Citrix NetScaler ADC and Gateway devices.
- The attackers deployed a customized version of the open-source Platypus framework, compiled for FreeBSD, to maintain persistent control over compromised systems.
- CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog after receiving global intelligence on the exploitation campaigns.
Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to install a modified version of the Platypus remote administration tool on exposed appliances. This activity, which began around September 24, 2026, targets Application Delivery Controller and Gateway instances that sit between corporate networks and the public internet, according to Cyber Security News.
Binary Defense researchers investigated intrusions involving two NetScaler devices. One appliance showed evidence of exploitation and payload delivery, while the other showed signs of exploitation without confirmed follow-on malicious activity, according to GBHackers. The attackers used the vulnerabilities to deploy a custom-built FreeBSD-compatible Platypus agent, creating a persistent remote-access foothold. These appliances often handle VPN access and load balancing, making them high-value targets for threat actors seeking internal network access, as noted by the Cybersecurity and Infrastructure Security Agency.
Vulnerability Details and Exploitation Mechanics
The campaign targets CVE-2026-88771 and CVE-2026-88772, both rated with a CVSS score of 9.5. CVE-2026-88771 is an improper input validation flaw that allows unauthenticated remote command execution without requiring valid user credentials. Attackers submit crafted data resembling a crash message from the packet engine, embedding shell commands in values written to NetScaler logs. A vulnerable error-handling script then processes this content, executing the injected payload.
CVE-2026-88772 involves a memory overflow in the NetScaler Packet Processing Engine related to Datagram Transport Layer Security. This flaw affects systems with DTLS enabled, which is the default setting on VPN virtual servers unless administrators disable it. Malformed handshake fragments are reassembled into buffers without sufficient bounds checking, leading to remote code execution or denial-of-service conditions. Detection is difficult because payload execution may be delayed by up to 24 hours until the monitoring script runs, according to GBHackers.
Persistence and Evasion Techniques
After gaining initial access, attackers deployed the Platypus implant using a one-line bootstrap command that downloaded an installer via curl and piped it to the shell. The malicious binary was disguised as a Perl-related file, such as .ns_09343.pl, to blend in with normal appliance files. The payload was stored in directories familiar to NetScaler administrators, including /var/tmp/, /netscaler.local/, and /var/core/.
This deployment method provides a persistent foothold that remains even if the organization patches the original vulnerability. A patch stops further exploitation of the flaw but does not automatically remove web shells, back
What to do and how to stay safe
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
