CVE-2026-88771MalwarePublished 10/20/2026

NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Affects Citrix NetScalerSource AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 09/27/2026
KEV deadline: 09/30/2026
EPSS: 4.7% chance of exploitation in 30 days – higher than 91% of CVEs

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.

Summary

This threat involves a sophisticated intrusion campaign targeting Citrix NetScaler ADC appliances running an affected 14.1 build. Attackers chained two vulnerabilities—CVE-2026-88771, a pre-authentication log-poisoning leading to remote code execution, and CVE-2026-88779, a SAML-parsing crash—to gain root-level code execution. The attackers deployed multiple persistence mechanisms including PHP web shells with cookie-based command channels, setuid shell modifications, cron entries, and boot hooks. They installed TCP session managers, HTTP tunnels, and outbound reverse agents to maintain command-and-control. A dedicated Go reconnaissance tool was used to map internal networks, including DNS, LDAP/Active Directory, management services, and VMware vCenter systems. The attackers implemented HA-aware persistence logic to synchronize implants across appliance pairs and force failovers. The campaign exfiltrated sensitive NetScaler configurations, historical data, and cryptographic key material, demonstrating a progression from initial foothold to a persistent platform for internal reconnaissance.

Impact

Successful exploitation allows attackers to achieve root code execution on vulnerable Citrix NetScaler ADC appliances, enabling full control over the device. This includes deploying persistent backdoors, establishing command-and-control channels, and conducting extensive internal reconnaissance. The attackers can exfiltrate sensitive configuration data, historical logs, and cryptographic keys, potentially compromising the confidentiality and integrity of the affected network environment. The persistence mechanisms and HA-aware implant synchronization increase the difficulty of detection and remediation.

Defensive guidance

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are available, organizations should monitor for indicators of compromise such as unusual PHP web shells, unauthorized cron jobs, and unexpected network tunnels on NetScaler appliances. Restrict administrative access to NetScaler devices and consider isolating affected appliances from critical internal networks. Follow vendor guidance closely once patches or mitigations are released.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

Indicators of compromise

IP addresses 6

179.60.146.241
46.151.182.18
62.133.62.80
31.56.197.72
192.159.99.139
209.74.64.192

CVEs 6

CVE-2026-88771
CVE-2026-88772
CVE-2026-88779
CVE-2026-97229
CVE-2026-104935
CVE-2026-102764

Hashes 10

b0871d353743fb2736f3b5ecf178788a
b215276fe51063cf2e4d38bbffddb112
30b71217b1e8d5b13394d4ffe3b11029d14adfa4
c6e443496337f0fab189bbbdfe91a102f1d56678
56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186
6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44
8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d
a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556
eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde
ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138