IN October 2026, Rapid7 disclosed a compromise of a Citrix NetScaler ADC appliance running a 14.1 build, where attackers exploited a chaining sequence involving CVE-2026-88771 and CVE-2026-88779. The intrusion achieved root code execution starting from attacker-controlled text inserted into a NetScaler authentication username, triggering a pre-authentication log-poisoning/RCE flaw (CVE-2026-88771) and a separate SAML parsing crash (CVE-2026-88779).
The evidence links the injected command, an nsaaad crash loop, a Pitboss reboot, post-reboot handler activity and eventual root payload execution, with multiple stages persisting across reboots. Rapid7 reports this was more than a one-off attempt, showing staged web shells, outbound command-and-control, internal tunnelling and staged exfiltration of NetScaler configuration and key material.
The analysis details a multi-phase operation: post-reboot persistence through cron, rc[.]netscaler and watchdog loops; an HA-aware approach to survive failover; a Go reconnaissance tool mapping DNS, LDAP/AD, management services and VMware vCenter; and a separate FreeBSD proxy agent. Two .slap dropper variants and a nsvmd Go agent were observed, enabling internal reconnaissance, tunnelling and key-material collection, with staging and exfiltration routes mapped to specific IPs and domains.
Rapid7 recommends applying the fixed builds for CVE-2026-88779 and CVE-2026-88771 (and CTX697096), rotating credentials, and hunting for the .slap, .relay and nsvm paths, unprivileged setuid/sh attempts, and the telltale nsaaad crashes and Pitboss reboots to detect and contain the campaign.