OTX Threat: Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators

CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. LevelBlue's Threat Hunt Operations & Research (THOR) team identified active exploitation across multiple customer environments featuring malicious authentication events with attacker-controlled usernames containing pitboss and NSPPE strings. Observed activities incl CVEs: CVE-2026-88771