citrix-netscaler-cve-2026-88771-iocs

Citrix NetScaler CVE-2026-88771: Indicators of Compromise

Indicators of Compromise (IoCs) observed by watchTowr Intel during in-the-wild exploitation of CVE-2026-88771, an unauthenticated command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway.

Indicators in this repository were captured across our sensor network of real NetScaler appliances, and is shared to help defenders hunt for exploitation and post-exploitation activity in their own environments.

Contents

• iocs.md - indicators and hunting guidance:
  • Behavioral indicators
  • Host-based artifacts (dropped files, backdoor accounts, backdoor keys)
  • Network indicators (source IP addresses, out-of-band callback domains, Sliver C2)
  • File hashes
  • Hunting commands for NetScaler appliances

References

• Citrix Security Bulletin CTX697096: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096