Citrix NetScaler Is Under Attack. Hackers Are Already Dropping Web Shells

• The Mess: CVE-2026-8452 in Citrix NetScaler ADC and Gateway is now being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog on August 26, while researchers have observed attackers dropping web shells and running discovery commands on compromised appliances.

This one has an interesting history.

When NetScaler disclosed the vulnerability in June, it was described as a memory-overflow issue that could cause unpredictable behavior or denial of service on affected Gateway and AAA configurations.

Then researchers looked closer.

WatchTowr demonstrated that the bug could be turned into unauthenticated remote code execution and published technical details and proof-of-concept code in August.

Now the theoretical part is over.

Attackers are using it.

According to observed exploitation, attackers have been dropping web shells and running basic commands such as id to check what level of access they obtained.

That’s usually not the end of the intrusion.

That’s the beginning.

Once a web shell lands on an Internet-facing appliance, the attacker has a foothold that doesn’t need a phishing email, stolen password or compromised employee account.

They got in through the box sitting at the edge of the network.

Again.

• The Damage: A successful attack can give an unauthenticated attacker remote code execution on a NetScaler appliance, creating a foothold for persistence, reconnaissance and potential movement toward internal systems.

And NetScaler appliances are attractive targets for a reason.

They often sit directly between the Internet and sensitive infrastructure.

VPN access.

Authentication.

Application delivery.

Remote access.

Traffic routing.

That makes a compromised appliance much more valuable than a random vulnerable web server.

The attacker doesn’t necessarily need to attack every workstation behind it.

They may already be standing at the front door.

The affected versions include NetScaler ADC and Gateway releases prior to 14.1-72.61 and 13.1-63.18, with affected FIPS and NDcPP builds also listed by NetScaler.

And this is not merely a lab demonstration anymore.

CISA’s KEV addition means there is sufficient evidence of real-world exploitation to move the vulnerability into the patch-now category. Federal agencies were given a remediation deadline of August 29.

That’s a three-day window.

Not a quarterly maintenance cycle.

• The Fix: Upgrade every affected NetScaler ADC and Gateway immediately to a fixed build, then investigate the appliance for signs of compromise instead of assuming that patching alone solves the problem. NetScaler’s guidance recommends upgrading vulnerable instances to a release containing the fix.

If the appliance was exposed before patching, start looking for evidence.

Check for:

• unexpected files or web shells;
• suspicious processes;
• unusual administrator activity;
• unexpected outbound connections;
• configuration changes;
• strange authentication or VPN activity;
• commands associated with discovery and post-exploitation.

And don’t make the classic mistake:

patch applied = incident over.

No.

The patch stops the known vulnerable path.

It does not remove an attacker’s persistence.

It does not delete a web shell.

It does not tell you what credentials were stolen.

And it definitely doesn’t guarantee that the appliance wasn’t compromised last week.

Bugstoday Opinion

This is another reminder that Internet-facing appliances are basically giant “please patch me” signs.

NetScaler already has a long history of attracting attackers because of where it sits.

At the perimeter.

In front of VPNs.

In front of authentication systems.

In front of everything interesting.

CVE-2026-8452 started life as what looked like a serious memory-overflow bug.

Researchers turned it into unauthenticated RCE.

Now attackers are dropping web shells.

That escalation happened fast.

Bugstoday verdict: if you’re running a vulnerable NetScaler, stop treating this as a vulnerability-management ticket. Treat it as a potential incident. Patch first. Hunt second. Assume nothing.