As cited
Copy frozen at (site build).
vulnerabilities
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance in early October 2026, revealing attackers chained CVE-2026-88771 and CVE-2026-88779 to achieve root execution and establish persistent access. The intrusion deployed PHP web shells, created multiple command-and-control channels, set setuid privileges on /bin/sh for privilege escalation, and used a dedicated Go reconnaissance tool to map internal DNS, LDAP, Active Directory, management services, and VMware vCenter infrastructure. The attackers staged and exfiltrated NetScaler configuration files, historical backups, and key material while maintaining resilience through crash-handler reboot loops, high-availability pair synchronization, and multiple persistence mechanisms including cron, boot scripts, and outbound reverse agents.
Why it matters: Organizations running exposed Citrix NetScaler ADC appliances must assume compromise if they were vulnerable during the active exploitation window; defenders should treat these appliances as potentially compromised, patch both CVE-2026-88771 and CVE-2026-88779 immediately, rotate all credentials and encryption keys stored on the device, hunt for the .slap, .relay, and .nsvm directories, and review outbound traffic and internal network scans originating from NetScaler addresses.
- Source published
- First seen by Cybersecurity Tracker