Pricing Contact Case Studies Research Talk to a Pentester ↗
POCFORGE RESEARCH 5 MIN READ Cloud security · Threat intel

Citrix NetScaler CVE-2026-88771 and CVE-2026-88779 Chained for Root: Patch, Hunt, Rotate

Attackers are chaining two KEV-listed NetScaler flaws for root access, web shells and internal reconnaissance. Patch both, hunt for compromise and rotate secrets.

Why this matters now. Rapid7 has published an incident analysis showing attackers chaining two NetScaler ADC flaws, both already in CISA’s Known Exploited Vulnerabilities catalogue, to gain root on an internet-facing appliance. The intruders planted hidden web shells, built HA-aware persistence, mapped Active Directory, DNS and vCenter from the appliance, and exfiltrated configuration and key material. If your NetScaler was exposed and unpatched during the campaign window, patch it, then hunt for compromise and rotate secrets.

What changed

On 19 October 2026 (updated 20 October), Rapid7 published an analysis of an early-October compromise of a Citrix NetScaler ADC running an affected 14.1 build. It confirms that attackers chained two vulnerabilities that defenders have been tracking separately:

  • CVE-2026-88771: a pre-authentication input-validation flaw that lets an unauthenticated attacker run commands (CVSS v4 9.5, default configuration, Citrix bulletin CTX697096). CISA added it to KEV on 27 September 2026.
  • CVE-2026-88779: a SAML parsing memory-buffer flaw that Citrix described as causing denial of service. CISA added it to KEV on 4 October 2026.

Background: our CVE-2026-88771 and CVE-2026-88772 defender checklist and our 5 October note on the CVE-2026-88779 SAML flaw.

According to Rapid7, the SAML flaw supplied a crash-and-reboot condition, and the first flaw supplied the attacker-controlled input. After the reboot, the appliance’s own crash-handling workflow ran that input as root. The attacker did not have to wait for a scheduled job to fire, and the same path re-ran payloads after later reboots over several days.

Rapid7 notes that the activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign.

What the intruders did after access

Rapid7 reports that the operator:

  • installed PHP web shells in the LogonPoint custom web directory, reachable through Apache aliases dressed up as CSS files and answering commands inside HTTP 404 responses;
  • set /bin/sh setuid and setgid so the web process could get root;
  • kept access through cron entries, rc.netscaler boot hooks, watchdog loops, an outbound reverse agent polling every 15 seconds, and an internal TCP pivot;
  • synchronised implant files to the HA peer and could force a failover so the infected node stayed active;
  • ran a Go scanner from the appliance to map internal routes, DNS, LDAP/Active Directory, management services and VMware vCenter;
  • staged and exfiltrated ns.conf and its historical copies, the HTTP configuration and system backups. These can contain encrypted admin passwords, LDAP and RADIUS bind credentials and SSL private keys.

Who is affected

Organisations running NetScaler ADC or NetScaler Gateway on builds that are vulnerable to either CVE, especially internet-facing Gateway or AAA deployments that use SAML. Citrix’s earlier guidance still applies: if you patched for the CVE-2026-88771 to CVE-2026-88778 bulletin but use SAML, you also needed the later CVE-2026-88779 fix.

What to do now

  1. Confirm you are on a fixed build for both CVEs. For CVE-2026-88779, Citrix’s fixed releases (Citrix security bulletin CTX697174) are 14.1-73.41 and 13.1-64.28 (14.1-73.41 FIPS, and 13.1-37.282 for 13.1 FIPS and NDcPP). Check the Citrix bulletins for the authoritative list, and confirm the CTX697096 fixes are in place too.
  2. Assume exposure if the appliance was vulnerable and reachable during the campaign. Rapid7’s view is that patching alone does not remove an existing foothold.
  3. Preserve evidence first. Collect volatile data and logs before you reboot or rebuild a suspect appliance.
  4. Check both nodes of every HA pair. The implant was built to survive on, and fail over to, the peer.
  5. Hunt on the appliance for:
    • hidden directories /nsconfig/.slap/, /nsconfig/.relay/ and /flash/.nsvm/;
    • unexpected files in /var/netscaler/logon/LogonPoint/custom/ (for example .slap.receiver, .ctxs.receiver, receiver.deb);
    • a setuid or setgid /bin/sh, unexpected PHP handlers, and CSS-looking Apache aliases in the HTTP configuration;
    • unexpected cron entries or changes to rc.netscaler;
    • repeated nsaaad crashes, Pitboss reboots, and records of the call-home crash handler running.
  6. Hunt on the network for outbound traffic from NetScaler addresses to the infrastructure Rapid7 lists, and for internal scanning, LDAP queries or DNS zone-transfer attempts that come from the appliance.
  7. If you find anything, rebuild and rotate. Rebuild from a known-good image on a fixed release. Rotate every credential and key that lived in /nsconfig, including LDAP and RADIUS credentials, SSL certificates and private keys. As a precaution, we also recommend rotating local admin (nsroot) and any TACACS/LDAP bind credentials the appliance holds. Then review the AD and vCenter accounts that the appliance could reach.

Why this matters for defenders

A remote-access appliance that runs as root and sits next to identity and virtualisation infrastructure is a valuable foothold. This case shows an operator using NetScaler as a reconnaissance platform, not just a door. A “denial of service” rating on an edge-device bug can understate the risk once it is chained with another flaw.

How PoCForge can help

PoCForge can review the exposure of your edge and remote-access appliances, validate patch and configuration state, and assess what an attacker could reach from a compromised gateway. All of this work is done within an authorised scope.

Sources

PoCForge publishes offensive-security research to explain attack paths and defensive controls. This article summarises public reporting only; it is not an exploit guide and does not describe a named client engagement.