CVE-2026-88771: Citrix NetScaler RCE Is Now a Botnet Recruiter
Honeypot telemetry shows CVE-2026-88771 going mass-market: webshells on Citrix NetScaler, SUID shells, and fresh hosts folded into DDoS botnets.
CVE-2026-88771 is a critical pre-authentication command injection in Citrix NetScaler ADC and NetScaler Gateway (CVSS 9.5) that yields root code execution and is now under mass exploitation. Track its exploitation timeline, IOCs and the post-exploitation chains that turn edge appliances into botnet nodes.
Honeypot telemetry shows CVE-2026-88771 going mass-market: webshells on Citrix NetScaler, SUID shells, and fresh hosts folded into DDoS botnets.