NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 spawn superusers and hide in CSS URLs

LevelBlue detailed post-exploitation payloads used after attacks on NetScaler via zero-days CVE-2026-88771 and CVE-2026-88772, both rated 9.5. A Perl script creates a superuser named sec_monitor, exfiltrates /flash/nsconfig to an external host, drops a PHP web shell disguised as a CSS URL, then deletes its own archive to erase evidence.

• CVE-2026-88771 is a 9.5 pre-auth command injection hitting all NetScaler ADC and Gateway deployments
• CVE-2026-88772 is a memory overflow via DTLS, enabled by default on VPN virtual servers
• Payload creates superuser sec_monitor and exfiltrates config to 64.94.85[.]67:443
• Citrix shipped fixes on September 27; CISA added both CVEs to its exploited catalog