Summary
Security researchers investigating Citrix NetScaler CVE-2026-62106 incidents have confirmed that attackers are deploying persistent web shells on compromised NetScaler appliances. Web shell deployment means patching CVE-2026-62106 does not remove attacker access from already-compromised appliances — the web shell provides a persistent backdoor that survives both patching and rebooting. Organizations that applied Citrix’s emergency patch must also conduct forensic triage to identify and remove any web shells installed during the exploitation window.
Timeline
| Date | Event |
|---|---|
| Prior to Sep 26, 2026 | CVE-2026-62106 exploited; web shells deployed on compromised appliances |
| Sep 26-28, 2026 | Citrix patches released; CISA October 1 deadline set; TTO-2026-0927-173 and TTO-2026-0928-176 published |
| Sep 29, 2026 | Security researchers confirm web shell deployment pattern; BleepingComputer reports persistence detail |
What Changed
Prior bulletins noted web shell risk as a general concern. Security researchers have now confirmed that web shell deployment is an active and documented element of the CVE-2026-62106 exploitation pattern. Web shells placed in the Citrix web application directory survive firmware updates and reboots because they exist as files on the appliance filesystem rather than in volatile memory. Patching CVE-2026-62106 prevents new exploitation but does not detect or remove shells already installed.
An organization that patched without first isolating and forensically examining their NetScaler appliances may have closed the initial access vector while leaving an active attacker backdoor in place. Indicators of compromise include unexpected .php or .jsp files in the Citrix web directory, unusual outbound connections from the appliance, and authentication log entries from unexpected IP addresses or times. Citrix has published updated guidance recommending full appliance re-imaging for any NetScaler that was internet-exposed while running a vulnerable version.
Domain Intelligence
citrix.com — 87.0
Score unchanged from TTO-2026-0927-173. citrix.com scores at 87.0 in the high-trust range.