Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors are actively exploiting CVE-2026-88771, a critical command injection vulnerability in Citrix NetScaler ADC and Gateway, to deploy web shells, create unauthorized superuser accounts, and exfiltrate configuration data. Attackers are deliberately obfuscating malicious web shells by mapping them to CSS-like URLs, making detection significantly harder for defenders relying on simple pattern matching. This attack chain demonstrates how unpatched network edge appliances become high-value footholds — granting attackers privileged access and persistence deep within an environment. The combination of superuser creation and configuration data theft means that even after remediation, stolen credentials and secrets may enable secondary intrusions, making rapid response and secret rotation critical.