NetScaler exploit attempts spread after proof-of-concept release

Attempts to exploit a NetScaler flaw have shifted from targeted activity to broad scanning of exposed, unpatched devices, Help Net Security reports. Researchers at Lupovis said their sensors recorded opportunistic attempts within minutes of the release of a proof-of-concept exploit for CVE-2026-88771. The flaw can be exploited remotely on unpatched devices using the default configuration. Citrix has issued patches and a script to help customers check for compromise, though it says the script may miss attacks. Censys detects around 42,000 internet-facing NetScaler ADC and Gateway hosts, but its scan cannot establish which are vulnerable or compromised.