Citrix Issues Emergency Fixes for 2 NetScaler Flaws After Platypus RAT Deployment

Attackers used two unpatched flaws in Citrix NetScaler appliances to install a persistent backdoor on network edge devices, compromising systems that sit between corporate networks and the public internet.

How it unfolded

• Around September 24, 2026, threat actors began targeting internet-exposed Citrix NetScaler ADC and Gateway instances using two critical zero-day vulnerabilities.
• On September 27, 2026, Citrix disclosed the flaws, CVE-2026-88771 and CVE-2026-88772, alongside six other issues, confirming attackers had already exploited them.
• Binary Defense researchers investigated two compromised devices, finding evidence of exploitation and the deployment of a modified Platypus remote access tool on one appliance.

Who is affected

Citrix NetScaler ADC and Gateway appliances are the primary targets, as these devices often manage application delivery, load balancing, and secure remote access at the network edge. Both vulnerabilities carry a CVSS v4 score of 9.5, indicating critical severity. CVE-2026-88771 affects all vulnerable deployments, including those with default configurations, requiring no user interaction or authentication. CVE-2026-88772 impacts systems with Datagram Transport Layer Security enabled, which is the default setting for VPN virtual servers.

What happens next

Citrix released emergency updates for the affected products after confirming active exploitation of unpatched, customer-managed deployments. The Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog, signaling urgent remediation is required. Researchers noted that attackers disguised the Platypus implant as a Perl-related file to blend in with normal appliance files, storing payloads in paths like /var/tmp/ and /var/core/.

The background in plain language

Edge appliances like NetScaler act as gatekeepers, handling traffic between the internet and internal corporate resources. When these devices are compromised, attackers gain a strategic foothold to monitor or manipulate data flows. Remote access tools, such as the modified Platypus framework seen here, allow threat actors to maintain control even after initial vulnerabilities are patched. Teams usually check for unauthorized binaries and monitor for unusual outbound connections to detect such persistent implants.

What to do and how to stay safe: Citrix

• Verify if your NetScaler ADC or Gateway appliances are running versions affected by CVE-2026-88771 or CVE-2026-88772 and apply emergency updates immediately.
• Check whether DTLS is enabled on your VPN virtual servers, as this feature is required for exploitation of CVE-2026-88772 and is on by default.
• Inspect logs for signs of the ns_monuploadd_err.pl script execution or delayed payload delivery, which may occur up to 24 hours after initial exploitation.
• Look for unfamiliar ELF binaries disguised as Perl scripts in directories like /var/tmp/ or /netscaler.local/ to identify potential Platypus implants.

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the two CVE IDs involved in this Citrix NetScaler exploitation campaign?

The vulnerabilities are tracked as CVE-2026-88771, an improper input validation flaw, and CVE-2026-88772, a DTLS memory overflow issue.

How did attackers disguise the Platypus remote access tool on the compromised appliances?

Attackers compiled the tool for FreeBSD and disguised it as a Perl-related file, using filenames like .ns_09343.pl to blend in with legitimate system files.

Does patching the vulnerabilities automatically remove the backdoor installed by attackers?

No, patching stops further exploitation of the flaws but does not remove existing web shells, backdoors, or remote access implants already placed on the device.