Analysis of active exploitation of newly discovered CVE-2026-88771 zero-day exploit traces one operator’s infrastructure to a four-node command-and-control cluster and releases more than 60 indicators that defenders can use and share without restriction
SARASOTA, Fla. — October 5, 2026 — TENEX, a fully-agentic, human-led security operations provider, released What TENEX.AI Observed Inside Active Exploitation of NetScaler Zero-Day on Oct. 1, documenting how attackers exploiting the Citrix NetScaler zero-day are installing a superuser account, hidden web shell and command-and-control agent that remain on the appliance even after it is patched.
Based on TENEX Threat Intelligence analysis of exploitation attempts against a NetScaler Gateway and payloads recovered from the attacker’s staging servers, the report maps the operator’s infrastructure to a four-node cluster sharing a single TLS certificate. Citrix released fixed builds on Sept. 27, CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and a public proof-of-concept on Sept. 28 was followed by mass scanning within a day.
Bashar Abouseido, President, TENEX
“Threat actors are using AI to compress the time between identifying a vulnerability, exploiting it, and at times to reverse engineer a patch. The speed of this one fits that pattern. The adversary isn’t waiting for anyone to catch up, so neither can we.”
Report Highlights
- Four staging servers used in roughly a day: The exploitation attempts rotated through four staging servers, each serving a different payload over a different port and download method. One path led to the Platypus agent, one to a Perl post-exploitation script, one to a Python reverse shell, and one to a direct binary download.
- One certificate exposed the cluster: All four command-and-control nodes present the same self-signed certificate, and a single pivot on its fingerprint turned one suspicious address into the full cluster. The certificate’s public-key hash and issuing CA give defenders pivots that survive a reissue.
- Footholds survived the patch: The Perl stage writes a superuser account named sec_monitor into the saved configuration, sets the SUID bit on /bin/sh, exfiltrates the configuration directory, and aliases a PHP web shell behind a stylesheet URL on the Citrix logon page. The Python stage replaces the appliance’s customsnmpd daemon with a reverse shell that NetScaler restarts itself.
- An agent built to outlast blocklists: The Platypus binary carries no C2 address. A bootstrap hands it the server and a one-time install token and installs it under appliance-style paths renamed as a NetScaler Perl script. Every build carries the same operator signing key, which outlasts any rebuild.
- Two waves over one flaw: A disciplined operator rebuilding its agent as the patch shipped, and a separate wave of commodity tooling (Global Socket Toolkit, netcat) after the public proof-of-concept. TENEX does not attribute the activity to a named actor.
Recommended Actions
The report recommends that any organization running NetScaler ADC or Gateway:
- Upgrade now: Move to 14.1-73.37, 13.1-64.23, or the FIPS and NDcPP equivalents, after confirming the identity provider signs SAML assertions.
- Check before clearing: On any appliance exposed before the upgrade, look for the sec_monitor account, a setuid /bin/sh, unexpected files under LogonPoint/, httpd.conf alias changes, a modified customsnmpd, and a client certificate under /var/core/.ns-cache/.
- Rotate after upgrading: Replace every credential, key, and certificate the appliance could reach, then revoke active sessions.
- Monitor the segment: Watch the appliance’s local network for the agent’s _platypus-mesh._tcp mDNS announcement.
To read the full report and download the indicator set, visit https://tenex.ai/blog/what-tenex-observed-inside-active-exploitation-of-netscaler-zero-day/.
About TENEX
TENEX.ai delivers fully-agentic, human-led security operations built by operators who have previously scaled MDR and founding engineers from Google Chronicle and leading AI labs. TENEX serves enterprise customers across the Google and Microsoft security ecosystems. Its Agentic Security Operations platform automates security workflows across the existing technology stack, with experienced human analysts providing oversight, judgment and accountability for critical decisions.
Backed by Crosspoint Capital Partners, Shield Capital, DTCP, Deepwork Capital and the Florida Opportunity Fund, with its seed round led in 2025 by Andreessen Horowitz (a16z), TENEX is headquartered in Sarasota, Florida, with offices in Overland Park, San Jose and Phoenix. Learn more at TENEX.ai.
Media Contact
TENEX Press Team
[email protected]