Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.

Summary from Rapid7 Blog.

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-88771Critical 9.5Known exploitedEPSS 1.1%
• CVE-2026-88779High 8.7Known exploitedEPSS 0.6%

Related coverage

Other sources covering the same vulnerabilities or event.

More in Threat Intel