Back Rapid7

NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Rapid7 • October 19, 2026

In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.

The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Directory, management services and VMware vCenter infrastructure, and exfiltrated NetScaler configuration and key material.

The activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign. However, this case provides additional detail on the operational lifecycle, including repeated post-reboot execution through the crash-handling workflow, HA-aware persistence, a dedicated Go reconnaissance tool, a separate FreeBSD proxy agent, and a staged collection pipeline.

The first confirmed root execution occurred shortly after attacker-controlled text was inserted into a NetScaler authentication username.

The injected text caused or immediately preceded repeated nsaaad crashes and a Pitboss reboot.

After reboot, the NetScaler call- crash handler processed the retained attacker-controlled text and executed a payload as root.

The attacker installed cookie-authenticated PHP web shells behind CSS-looking Apache aliases.

The attacker set /bin/sh to mode 6555, allowing an unprivileged web process to obtain effective root privileges.

The implant framework maintained access through cron, rc.netscaler, watchdog loops, an outbound reverse agent, and an HTTP-fronted TCP proxy.

HA synchronization and forced failover logic attempted to preserve access across the appliance pair.

A Go tool mapped internal routes, DNS, LDAP/AD, management services and VMware vCenter systems.

NetScaler configuration, historical configurations, HTTP configuration, diagnostics and system backup material were staged for exfiltration.

The first event was an authentication request containing attacker-controlled text similar to:

The observed chain was:

Figure 1: Sequence diagram showing the attack chain

Logs collected show attackers chaining CVE-2026-88771 , the pre-authentication log-poisoning/RCE issue, with CVE-2026-88779 , the separate SAML-parsing crash. A two-vulnerability sequence in which the SAML parsing flaw supplies a crash/reboot condition while the log-poisoning flaw supplies attacker-controlled command text.

The evidence demonstrates more than an attempted chain: the injected command, nsaaad crash loop, Pitboss reboot, post-reboot handler activity, and root payload execution are all directly correlated across independent logs and filesystem timestamps. The first implant files were created at the same second as the first logged post-reboot execution, and later stages, web shells, tunnels, reconnaissance tooling and exfiltration were confirmed.

Rapid7 also published an ETR on the Netscaler zero days currently exploited in the wild.

Repeated post-reboot execution

The initial execution was not a one-time event. The appliance recorded repeated Pitboss-initiated reboots and repeated call- handler executions over several days.

The handler re-executed stages from multiple infrastructure addresses and the repeated execution model allowed the operator to refresh persistence, deploy new components and continue collection after appliance restarts.

The crash-handling path functioned as a delayed and repeatable execution trampoline, the chaining happened to avoid waiting 24h for the injected payload to run.

Two .slap dropper versions were recovered:

The later version added reverse-agent functionality, relay installation, HA recovery, stage tracking, and structured upload logging, indicating operational maturation during the campaign.

The nsvmd installer branch was separately identified as:

Persistence and web shells

The main framework used a directory under /nsconfig/.slap.

It deployed three web shell copies into the LogonPoint custom web directory:

The shells used a cookie-based command channel. Commands were supplied through a second cookie and returned through an HTTP 404 response body. The 404 response helped the shell blend into normal web traffic and made successful command requests resemble missing resources.

The attacker modified Apache configuration to:

execute .deb files as PHP;

enable PHP execution;

map CSS-looking URLs to .slap.receiver;

accept randomized hexadecimal CSS suffixes;

preserve an attacker backup of the HTTP configuration.

The alias created were the following:

This made the shell setuid and setgid. Because Apache normally runs with reduced privileges, this provided a path for the PHP web shell to obtain effective root privileges.

The framework also reseeded cron entries and boot hooks whenever it ran. This made the compromise resilient to reboots, image regeneration and loss of individual cron entries.

Tunnelling and command channels

The intrusion deployed multiple redundant access paths.

Perl TCP session manager

agent.pl created a loopback listener on an ephemeral port and recorded it in /tmp/.uxdport

It used /tmp/.uxdlock for process coordination and supported operations including:

The open operation accepted arbitrary destination hosts and ports, turning the NetScaler into an internal TCP pivot.

The Python components provided a local session manager and HTTP front end:

it accepted base64 commands in an HTTP header and returned tunnel responses in HTTP 404 bodies. This behavior overlaps with publicly reported WHIPSHOT/SLAPSHOT tooling.

Outbound reverse agent

The reverse agent polled an external command endpoint every 15 seconds, executed the received command with /bin/sh -c, and returned output using HTTP PUT. This gave the operator command execution without requiring an inbound connection to the appliance.

The framework included explicit HA recovery logic:

The code attempted to synchronize implant files to the HA peer and, when appropriate, force failover so the node containing the implant became active.

Internal reconnaissance

A stripped, statically linked FreeBSD Go binary was recovered from the .slap directory. The tool was designed to map infrastructure reachable from the compromised appliance.

It contains functionality associated with:

local interface and route parsing;

gateway-prefix discovery;

DNS server and domain discovery;

DNS zone-transfer hunting;

LDAP anonymous bind and RootDSE queries;

management-service checks;

TLS certificate inspection;

VMware vCenter classification.

A launcher named vcscan-agent.sh downloaded and validated the scanner as scanner-freebsd-amd64, installed it as /nsconfig/.slap/vc, and ran two stages: broad scanning of RFC1918 space and management-focused scanning of ranges derived from DNS and LDAP results. The launcher collected route, DNS, LDAP, management and vCenter results into files such as:

It then compressed and uploaded the results to the operator infrastructure.

This reconnaissance component addition confirms the campaign is active and developing, mapping the identity, management and virtualization infrastructure from a compromised ADC vantage point.

The second payload branch deployed a FreeBSD Go agent named nsvmd through injection of 2.sh/r.sh under /flash/.nsvm/nsvmd:

The agent was started with:

The installer created a 45s watchdog (/flash/.nsvm/watchdog.sh), boot persistence through /nsconfig/rc.netscaler, 5 minute and daily cron persistence (/flash/.nsvm/ guard.sh ,/flash/.nsvm/restart.sh) marking nsvmd immutable using chflags uchg. Agent logs were collected under /flash/.nsvm/.agent.log and /flash/.nsvm/.wd.log.

Configuration and key-material collection

The attacker staged and uploaded:

The configuration archive could contain encrypted credentials, LDAP/RADIUS bind information, administrative configuration, SSL private keys and key-encryption material. The collection logic also uploaded manifests and stage logs and retried failed uploads.

A separate archive was staged in the web root and successfully downloaded through an HTTP 200 request. The response size matched the staged archive size, providing direct evidence of configuration exfiltration through the web interface.

MITRE ATT&CK techniques

Exploit Public-Facing Application

Ingress Tool Transfer

Obfuscated Files or Information

File and Directory Removal

System Network Configuration Discovery

Remote System Discovery

Network Service Scanning

Data from Local System

Archive Collected Data

Exfiltration Over C2 Channel

Automated Exfiltration

Table 1: MITRE ATT&CK Tactics and Techniques

Indicators of compromise

Main framework directory

Relay implant directory

Reconnaissance scanner binary

/nsconfig/.slap/vcscan-agent.sh

Reconnaissance scanner launcher script

/nsconfig/.slap/agent.pl

Perl TCP session manager and pivot agent

/nsconfig/.slap/bridge.pl

/nsconfig/.slap/boot.sh

Boot persistence script

/nsconfig/.slap/reverse-agent.sh

Outbound reverse command execution agent

/nsconfig/.relay/run.sh

/nsconfig/.relay/target_agent.py

Python relay agent script

FreeBSD Go proxy agent binary

/flash/.nsvm/watchdog.sh

45-second watchdog script for nsvmd

/flash/.nsvm/guard.sh

Cron persistence guard script

/flash/.nsvm/restart.sh

/flash/.nsvm/nsvmd.tmp

Temporary nsvmd binary path

Uninstall/upgrade control marker

/flash/.nsvm/.agent.log

Loot staging directory

/var/tmp/.ux/slapshot.py

Python HTTP tunnel/session manager component

/var/tmp/.ux/whipd.py

Python HTTP tunnel front-end component

Process coordination lock file

Ephemeral loopback port recording file

/var/netscaler/logon/LogonPoint/custom/.slap.receiver

/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver

/var/netscaler/logon/LogonPoint/custom/receiver.deb

/nsconfig/.slap/.slap.receiver

/nsconfig/.slap/.ctxs.receiver

/nsconfig/.slap/receiver.deb

Table 2: Malicious files and filesystem paths

6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44

a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556

56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186

8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d

scanner-freebsd-amd64

eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde

ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138

Table 3: SHA-256 file hashes

C2 domain used by nsvmd

.slap C2, relay, reverse-agent and loot-upload infrastructure

Stage server used to deliver /v, 1.sh/17447d.sh, and collect staged data

stage/loot infrastructure on port 30444

Table 4: Network indicators of compromise

YARA rules and more IoCs are available in Rapid7’s Intelligence Hub along with ongoing intelligence on the latest campaigns.

Defensive recommendations

Patch NetScaler appliances to the applicable CVE-2026-88779 and CVE-2026-88771 fixed builds and verify the earlier CTX697096 fixes.

Treat Internet-facing appliances as potentially compromised if they were vulnerable during the campaign window.

Collect volatile evidence before rebooting or rebuilding when compromise is suspected.

Inspect both nodes of every HA pair.

Hunt for the .slap, .relay and .nsvm paths.

Hunt for setuid /bin/sh, unauthorized Apache PHP handlers and CSS-looking aliases.

for nsaaad crashes, Pitboss reboots and ns_monuploadd_err.pl execution records.

Rotate all credentials and keys exposed through /nsconfig, including LDAP/RADIUS credentials and encryption-related material.

Review outbound traffic for the listed infrastructure and internal scanning from NetScaler source addresses.

This incident demonstrates how a NetScaler compromise can evolve from a pre-authentication injection into a persistent appliance-resident intrusion platform. The attacker combined web shells, setuid privilege persistence, outbound command execution, internal TCP tunnelling, HA manipulation, environment reconnaissance and automated configuration exfiltration.

The most significant new findings are the observed chaining of CVE-2026-88779 and CVE-2026-88771 and the dedicated reconnaissance workflow. Rather than using the ADC only as a foothold, the operator used it as a privileged vantage point to map internal networks, identity services, management infrastructure and virtualization systems. This provides defenders with additional high-value hunting opportunities and shows why patching alone is insufficient after an Internet-facing NetScaler has been exposed to active exploitation.

Emergent Threat Response

Extracted Entities

Domains (12)

17447d.sh 1.sh 2.sh agent.pl boot.sh bridge.pl guard.sh restart.sh reverse-agent.sh r.sh vcscan-agent.sh watchdog.sh

SHA256 Hashes (6)

56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138