Citrix NetScaler Flaw Exploited: Attackers Create Superuser and Hide Web Shell in Plain Sight

Michael Miller · 2026-10-01

### Citrix NetScaler Under Attack: The Latest Exploit Threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This flaw allows them to drop web shells and attempt to steal configuration data. The LevelBlue Threat Hunt Operations & Research (THOR) team has been tracking this activity across multiple customer environments. They've identified malicious NetScaler payloads that do more than just open a backdoor—they create a superuser account and map the web shell to CSS-like URLs to evade detection. ### What Exactly Is Happening? In simple terms, attackers are using a flaw that doesn't require them to log in first. They can send a specially crafted request to a vulnerable NetScaler device and execute commands. Once inside, they deploy a web shell—a script that lets them run commands remotely. But this isn't your average web shell. It's cleverly disguised. The attackers map it to URLs that look like CSS files, which are normally harmless. This makes it harder for security tools to spot. ### Why Should You Care? If your organization uses Citrix NetScaler for remote access or load balancing, this is a big deal. NetScaler is often exposed to the internet, making it a juicy target. Once attackers create a superuser account, they have full control. They can steal data, move laterally, or install more malware. The fact that they're hiding the web shell in CSS-like URLs means traditional detection might miss it. > "The exploitation of this vulnerability is a wake-up call. Attackers are getting smarter about hiding their tracks, and we need to be equally smart about hunting them down." – Michael Miller, Lead Antidetect Browser Strategist & Architect ### How to Protect Your NetScaler First, patch immediately. Citrix has released updates for this vulnerability. If you haven't applied them, do it now. Second, monitor for unusual activity. Look for unexpected superuser accounts or strange URL patterns in your logs. Third, consider using an antidetect browser for your security team's research. It helps you browse the web without leaving a trace, which is useful when investigating threat actors. Finally, segment your network so that even if NetScaler is compromised, attackers can't easily reach critical systems. ### The Bigger Picture This incident shows how attackers are evolving. They're not just smashing and grabbing; they're using stealthy techniques to stay under the radar. As a professional in the antidetect browser space, I've seen how important it is to stay anonymous online. But the same tools that protect privacy can also be used by attackers. That's why it's crucial to understand both sides. ### Key Takeaways - Patch your Citrix NetScaler devices immediately. - Monitor for superuser accounts and CSS-like URLs. - Use antidetect browsers for secure research and threat hunting. - Stay informed about the latest exploits and mitigation strategies. Remember, cybersecurity is a cat-and-mouse game. The more you know, the better you can defend.