Item 1 in the brief for Tue, Oct 20

Citrix NetScaler flaws chained to gain root and plant web shells, Rapid7 says

An attacker chained two Citrix NetScaler ADC flaws to run commands as root without credentials, then planted web shells and took the appliance’s configuration and keys, Rapid7 says. Both flaws, and , are in KEV, and Citrix disclosed them with fixed builds for customer-managed appliances on Sep 27 and Oct 3. Rapid7 says an appliance exposed while vulnerable needs more than the patch.

Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, or before 14.1-73.41 and 13.1-64.28 on SAML setups, plus FIPS and NDcPP builds. All versions and fixes
CVE
Vendor: Citrix
Published: Oct 20, 6:00 a.m. ET
Editor: Austin Simas

Details

In the intrusion Rapid7 investigated in early October, the attacker first hid a command in the username of a sign-in request, using , which Rapid7 calls a log-poisoning flaw. It then used , a memory flaw in NetScaler’s SAML parsing, to crash the authentication service, nsaaad, until the Pitboss process rebooted the appliance. After the reboot, NetScaler’s call-home crash handler processed the stored text and ran the command as root. Rapid7 says chaining the flaws spared the attacker a 24-hour wait for the command to run.

With root access, the attacker put three copies of a PHP web shell in the sign-in page’s custom folder, one reached through addresses made to look like style sheets. It made /bin/sh setuid, which gave the web shell a path to root privileges. Cron jobs, startup scripts, watchdog loops and an agent that polled for commands every 15 seconds kept its access through reboots. The attacker also tried to copy its files to the other node of a high-availability pair and force a failover to the node holding them.

A scanner written in Go mapped internal routes, DNS and directory servers, management services and VMware vCenter servers from the appliance. The attacker took copies of /nsconfig, older configurations and backups. Rapid7 says they can hold encrypted credentials, the appliance’s logins for directory and authentication servers, and certificate private keys. It advises rotating all of them and treating any internet-facing appliance that was vulnerable during the attacks as potentially compromised.

Citrix says affects every customer-managed appliance, even in its default setup, including NetScaler instances in Secure Private Access hybrid deployments. affects only appliances set up as a SAML service provider or identity provider. Citrix says it has seen exploits of on appliances without its fixes. CISA lists both flaws as exploited and flags for forensic triage. Rapid7 says the activity overlaps with public reporting on a NetScaler campaign called WHIPSHOT/SLAPSHOT, and that the attacker repeated the crash cycle over several days to refresh its tools.

Rapid7 hasn’t named the attacker or the victim, or said how many appliances it has seen compromised, and Citrix hasn’t said how widely either flaw is exploited. Rapid7 says more indicators and detection rules are in its Intelligence Hub for customers.

What to do

8 steps

1Upgrade customer-managed NetScaler ADC and Gateway to 14.1-73.41, 13.1-64.28 or a later build, or the FIPS and NDcPP builds in the versions table, which fix both flaws.
2Collect volatile evidence before rebooting or rebuilding any appliance suspected of compromise, as Rapid7 advises.
3Inspect both nodes of every high-availability pair.
4Hunt for the /nsconfig/.slap, /nsconfig/.relay and /flash/.nsvm directories, where Rapid7 found the attacker’s tools.
5Check for a setuid /bin/sh, unauthorized Apache handlers that run PHP and aliases that make hidden files look like style sheets.
6Search logs for nsaaad crashes, Pitboss reboots and records of ns_monuploadd_err.pl running.
7Rotate every credential and key stored in /nsconfig, including the appliance’s accounts for directory and authentication servers and its encryption keys.
8Check network logs for outbound traffic to the indicators table’s domain and IP addresses, and for internal scanning from NetScaler addresses.

Affected and fixed versions

Product	Affected	Fixed
NetScaler ADC and Gateway 14.1	before `14.1-73.37`, and before `14.1-73.41` on SAML setups	`14.1-73.41` or later
NetScaler ADC and Gateway 13.1	before `13.1-64.23`, and before `13.1-64.28` on SAML setups	`13.1-64.28` or later releases of `13.1`
NetScaler ADC 14.1-FIPS	before `14.1-73.37` FIPS, and before `14.1-73.41` FIPS on SAML setups	`14.1-73.41` FIPS or later
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	before `13.1-37.279`, and before `13.1-37.282` on SAML setups	`13.1-37.282` or later

Product
NetScaler ADC and Gateway 14.1
Affected
before 14.1-73.37, and before 14.1-73.41 on SAML setups
Fixed
14.1-73.41 or later
Product
NetScaler ADC and Gateway 13.1
Affected
before 13.1-64.23, and before 13.1-64.28 on SAML setups
Fixed
13.1-64.28 or later releases of 13.1
Product
NetScaler ADC 14.1-FIPS
Affected
before 14.1-73.37 FIPS, and before 14.1-73.41 FIPS on SAML setups
Fixed
14.1-73.41 FIPS or later
Product
NetScaler ADC 13.1-FIPS and 13.1-NDcPP
Affected
before 13.1-37.279, and before 13.1-37.282 on SAML setups
Fixed
13.1-37.282 or later

Indicators

Domains and IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
SHA-256		1.sh, the later version of the dropper
SHA-256		17447d.sh, the earlier version of the dropper
SHA-256		2.sh or r.sh, the installer for the nsvmd proxy agent
SHA-256		scanner-freebsd-amd64, the scanner file the launcher downloaded
SHA-256		vc, the reconnaissance scanner binary in /nsconfig/.slap
SHA-256		nsvmd, a FreeBSD proxy agent written in Go
Domain		Command server for the nsvmd agent
IP address		Command server for the nsvmd agent
IP address		Command, relay and upload server for the main implant
IP address		Staging server that delivered payloads and collected stolen data
IP address		Served the 1.sh dropper
IP address		Staging and upload server on port 30444
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
IP address		Payload delivery server
File name		Web shell, reached through aliases that look like style sheets
File name		Web shell copy
File name		Web shell copy that Apache was set to run as PHP

SHA-2561.sh, the later version of the dropper
SHA-25617447d.sh, the earlier version of the dropper
SHA-2562.sh or r.sh, the installer for the nsvmd proxy agent
SHA-256scanner-freebsd-amd64, the scanner file the launcher downloaded
SHA-256vc, the reconnaissance scanner binary in /nsconfig/.slap
SHA-256nsvmd, a FreeBSD proxy agent written in Go
DomainCommand server for the nsvmd agent
IP addressCommand server for the nsvmd agent
IP addressCommand, relay and upload server for the main implant
IP addressStaging server that delivered payloads and collected stolen data
IP addressServed the 1.sh dropper
IP addressStaging and upload server on port 30444
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
IP addressPayload delivery server
File nameWeb shell, reached through aliases that look like style sheets
File nameWeb shell copy
File nameWeb shell copy that Apache was set to run as PHP

Timeline

Sep 27Citrix discloses with fixed builds for customer-managed appliances.
Sep 27CISA adds to KEV.
Oct 3Citrix discloses , a memory flaw that can crash appliances set up for SAML.
Oct 4CISA adds to KEV.
Oct 19Rapid7 publishes its analysis of an early-October intrusion that chained the two flaws.

Sources

Rapid7Primary source rapid7.com
Citrix security bulletin CTX697096Primary source support.citrix.com
Citrix security bulletin CTX697174Primary source support.citrix.com
CISA KEV catalog, CVE-2026-88771Primary source cisa.gov
CISA KEV catalog, CVE-2026-88779Primary source cisa.gov