Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor

What happened

In contrast, the other showed signs of exploitation without confirmed follow-on malicious activity. Citrix NetScaler Zero-Days The campaign began around September 24, 2026, targeting internet-exposed Citrix NetScaler ADC and Gateway instances through vulnerabilities CVE-2026-88771 and CVE-2026-88772.

Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices.

One appliance showed evidence of exploitation […] The post Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . CVE/vulnerability Cyber Security News Vulnerabilities 3 min.

One appliance showed evidence of exploitation and payload delivery. The attackers used their access to install a customized FreeBSD-compatible Platypus agent, turning the network edge device into a potential persistent remote-access foothold.

CVE-2026-88771 is a pre-authentication command-injection flaw . Attackers can submit crafted data that resembles a crash message from the NSPPE packet engine, embedding shell commands in a value later written into NetScaler logs.