Rapid7 Details NetScaler Intrusion Chaining Two CVEs to Establish Persistent Access
Summary
Rapid7 traced a NetScaler intrusion that chained CVE-2026-88771 and CVE-2026-88779 to gain root execution, maintain access, map internal systems, and exfiltrate configuration data. The investigation provides technical findings and defensive guidance.
Key points
- Rapid7 correlated attacker-controlled authentication text, nsaaad crashes, a Pitboss reboot, and post-reboot handler activity with root payload execution.
- The intrusion chained CVE-2026-88771, a pre-authentication log-poisoning/RCE issue, with CVE-2026-88779, a SAML-parsing crash flaw.
- Attackers installed cookie-authenticated PHP web shells and used cron jobs, boot hooks, watchdogs, and HA synchronization to maintain access.
- Multiple command channels enabled outbound control and internal TCP tunneling; attackers also attempted to preserve access across an HA pair.
- A recovered Go reconnaissance tool mapped routes, DNS, LDAP/Active Directory, management services, and VMware vCenter systems.
- Rapid7 found configuration and system backup material staged and exfiltrated; a successful HTTP download matched the staged archive’s size.
- Rapid7 recommends patching affected appliances, investigating exposed systems and both HA nodes, collecting evidence before rebuilding, and rotating potentially exposed credentials and keys.
Article Details
- Attack Vectors
- Attackers chained CVE-2026-88771, a pre-authentication log-poisoning/RCE vulnerability, with CVE-2026-88779, a SAML-parsing crash vulnerability. Attacker-controlled text in an authentication username was later processed by the call-home crash handler, which executed a payload as root after a reboot.
- The intrusion established persistence through cron, rc.netscaler, watchdog loops, HA synchronization and failover logic, and PHP web shells hidden behind CSS-looking Apache aliases. Setting /bin/sh to mode 6555 enabled an unprivileged web process to obtain effective root privileges.
- The attackers used outbound command-and-control, an HTTP-fronted TCP proxy for internal pivoting, and a Go reconnaissance tool to map routes, DNS, LDAP/Active Directory, management services, and VMware vCenter systems.
- The attackers staged and exfiltrated NetScaler configurations, diagnostics, system backups, and potentially exposed credentials and key material.
- Defensive Notes
- Patch NetScaler appliances to fixed builds for CVE-2026-88779 and CVE-2026-88771, and verify the earlier CTX697096 fixes.
- Treat Internet-facing appliances that were vulnerable during the campaign window as potentially compromised. Collect volatile evidence before rebooting or rebuilding, and inspect both nodes of every HA pair.
- Hunt for the .slap, .relay, and .nsvm paths; setuid /bin/sh; unauthorized Apache PHP handlers and CSS-looking aliases; and nsaaad crashes, Pitboss reboots, and ns_monuploadd_err.pl execution records.
- Review outbound traffic for the listed infrastructure and investigate internal scanning originating from NetScaler appliances.
- Rotate credentials and keys exposed through /nsconfig, including LDAP/RADIUS credentials and encryption-related material.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | v5v[.]in | C2 domain used by the nsvmd agent and to retrieve its installer script. |
| IPV4 | 130[.]94[.]20[.]222 | Payload-delivery infrastructure. |
| IPV4 | 132[.]243[.]166[.]140 | Payload-delivery infrastructure. |
| IPV4 | 173[.]231[.]39[.]244 | Payload-delivery infrastructure. |
| IPV4 | 179[.]60[.]146[.]241 | Server identified as delivering the 1.sh payload. |
| IPV4 | 192[.]159[.]99[.]139 | .slap C2, relay, reverse-agent, and loot-upload infrastructure. |
| IPV4 | 199[.]233[.]217[.]13 | Payload-delivery infrastructure. |
| IPV4 | 209[.]74[.]64[.]192 | C2 infrastructure used by nsvmd. |
| IPV4 | 213[.]209[.]159[.]55 | Stage server used to deliver payloads and collect staged data. |
| IPV4 | 31[.]56[.]197[.]72 | Payload-delivery infrastructure. |
| IPV4 | 45[.]92[.]1[.]17 | Stage and loot infrastructure, listed on port 30444. |
| IPV4 | 46[.]151[.]182[.]18 | Payload-delivery infrastructure. |
| IPV4 | 62[.]133[.]62[.]80 | Payload-delivery infrastructure. |
| IPV4 | 64[.]94[.]85[.]67 | Payload-delivery infrastructure. |
| SHA256 | 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 | Hash of the recovered 2.sh / r.sh installer for the nsvmd payload branch. |
| SHA256 | 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 | Hash of the recovered malicious 1.sh dropper. |
| SHA256 | 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d | Hash of the recovered scanner-freebsd-amd64 reconnaissance binary. |
| SHA256 | a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 | Hash of the recovered malicious 17447d.sh dropper. |
| SHA256 | eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde | Hash of the recovered vc reconnaissance binary. |
| SHA256 | ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 | Hash of the recovered nsvmd proxy agent binary. |
MITRE ATT&CK
T1005 · Data from Local SystemThe attackers collected NetScaler configurations, diagnostics, and system backup material from the appliance.T1037.004 · RC ScriptsThe framework used /nsconfig/rc.netscaler as a boot persistence hook.T1041 · Exfiltration Over C2 ChannelThe reverse agent returned command output over HTTP, and staged data was uploaded to operator infrastructure.T1046 · Network Service DiscoveryThe Go reconnaissance tool scanned internal ranges for management services and VMware vCenter systems.T1053.003 · CronCron entries maintained persistence for the implant framework and nsvmd agent.T1059.004 · Unix ShellInjected commands and downloaded payloads were executed through /bin/sh.T1059.006 · PythonPython components provided the local session manager and HTTP tunnel front end.T1059.007 · JavaScriptPHP web shells accepted cookie-supplied commands and returned their output in HTTP 404 responses.T1074.001 · Local Data StagingCollected files and reconnaissance results were staged locally before upload.T1090.001 · Internal ProxyThe Perl session manager accepted arbitrary destination hosts and ports, using the appliance as an internal TCP pivot.T1105 · Ingress Tool TransferShell commands downloaded payloads and tools, including r.sh and the reconnaissance scanner.T1190 · Exploit Public-Facing ApplicationThe intrusion exploited pre-authentication NetScaler vulnerabilities to obtain root execution on an Internet-facing appliance.T1505.003 · Web ShellCookie-authenticated PHP web shells were installed in the NetScaler LogonPoint custom web directory.T1548.001 · Setuid and SetgidThe attackers set /bin/sh to mode 6555 to allow an unprivileged web process to obtain effective root privileges.T1560.001 · Archive via UtilityThe reconnaissance results were compressed, and collected configuration and system material was staged in archives.
CVE
CVE-2026-88771Logs collected show attackers chaining CVE-2026-88771, the pre-authentication log-poisoning/RCE issue, with CVE-2026-88779, the separate SAML-parsing crash. A two-vulnerability sequence in which the SAML parsing flawCVE-2026-88779show attackers chaining CVE-2026-88771, the pre-authentication log-poisoning/RCE issue, with CVE-2026-88779, the separate SAML-parsing crash. A two-vulnerability sequence in which the SAML parsing flaw
Vendors
Products
NetScaler ADCIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScalerVMware vCenterperformed targeted reconnaissance of DNS, LDAP/Active Directory, management services and VMware vCenter infrastructure, and exfiltrated NetScaler configuration and key material.
Tools
nsvmdThe nsvmd installer branch was separately identified as:scanner-freebsd-amd64A launcher named vcscan-agent.sh downloaded and validated the scanner as scanner-freebsd-amd64, installed it as /nsconfig/.slap/vc, and ran two stages: broad scanning of RFC1918 space and management-focused scanning of