NetScaler Crash Handler Turned Into a Root Shell, Rapid7 Finds
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
Rapid7 has published a teardown of a compromised Citrix NetScaler appliance where attackers chained two bugs that are already on CISA’s exploited list. According to Rapid7’s analysis, the attackers put command text into a login username field (CVE-2026-88771). They then used a SAML-parsing crash (CVE-2026-88779) to force repeated crashes and a reboot. After the reboot, NetScaler’s own crash-reporting handler picked up the planted text and ran it as root. What followed was a long list of persistence tricks, web shells, internal scanning and theft of the appliance’s configuration.
For defenders
Products: NetScaler ADC and NetScaler Gateway. Rapid7’s case involved a 14.1 build. CVE-2026-88771 is improper input validation leading to RCE (CVSS v4 9.5) and works in default configurations. CVE-2026-88779 is a memory overflow in SAML processing (CVSS v4 8.7) and only matters when a SAML SP or IdP is configured. CISA lists both as exploited (KNOWN). No public PoC is referenced.
Fixed builds (per Citrix CTX697174, as summarized in Rapid7’s ETR). These supersede the September CTX697096 fixes: 14.1-73.41+, 13.1-64.28+, 14.1-73.41 FIPS+, and 13.1-FIPS/NDcPP 13.1-37.282+.
Post-exploitation, per Rapid7: a hidden framework under /nsconfig/.slap that persists through cron, rc.netscaler and boot hooks, and is aware of HA pairs (it copies itself to the peer and forces failover). The attackers dropped cookie-authenticated PHP shells in the LogonPoint custom directory and set /bin/sh to setuid/setgid (mode 6555). Rapid7 also found Perl/Python tunnels, a 15-second polling reverse agent, a FreeBSD Go scanner that probes AD, DNS and vCenter, and a second proxy implant (nsvmd) made immutable with chflags. Config files and backups, including LDAP/RADIUS bind data and SSL keys, were staged and exfiltrated. Rapid7 notes the activity overlaps with the reported WHIPSHOT/SLAPSHOT campaign and names no actor. Techniques include T1190 (Exploit Public-Facing Application), T1505.003 (Server Software Component: Web Shell), T1548.001 (Abuse Elevation Control Mechanism: Setuid and Setgid), T1053.003 (Scheduled Task/Job: Cron), T1552.001 (Unsecured Credentials: Credentials In Files) and T1041 (Exfiltration Over C2 Channel).
v5v[.]in
c[.]v5v[.]in
209.74.64[.]192
192.159.99[.]139
213.209.159[.]55
179.60.146[.]241
45.92.1[.]17 (port 30444)
62.133.62[.]80
46.151.182[.]18
132.243.166[.]140
199.233.217[.]13
31.56.197[.]72
64.94.85[.]67
130.94.20[.]222
173.231.39[.]244/nsconfig/.slap/
/nsconfig/.relay/
/flash/.nsvm/
/var/tmp/.s2loot/
/var/tmp/.ux/slapshot.py
/var/tmp/.ux/whipd.py
/var/netscaler/logon/LogonPoint/custom/.slap.receiver
/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
/var/netscaler/logon/LogonPoint/custom/receiver.deb
ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 (nsvmd)
8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d (scanner-freebsd-amd64)
56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 (2.sh / r.sh)
6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 (1.sh)What it means for you
NetScaler boxes are the front door that lets staff sign in to a company’s network from outside. If you don’t run one, there’s nothing to do here. If your business does, or an IT provider runs one for you, ask whether it has been updated since early October and checked for signs of intrusion. A box that was broken into before the update can stay compromised afterward, because the update doesn’t remove anything the attackers left behind.
Do this now
1. Upgrade every NetScaler ADC/Gateway to the CTX697174 builds above. That includes boxes you patched in September for CTX697096.
2. Before rebooting, collect volatile evidence. On both HA nodes, hunt for the hidden .slap, .relay and .nsvm directories, a setuid /bin/sh, and odd PHP handlers or aliases in the Apache config. Check logs for nsaaad crashes and Pitboss reboots. Citrix’s CTX694799 covers next steps.
3. If a box was exposed while unpatched, treat it as compromised. Rotate every credential and key stored in /nsconfig, including LDAP/RADIUS bind accounts and SSL certificates.
4. Block the listed infrastructure, and alert on internal scanning that originates from NetScaler addresses.