Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
MentionsCitrixNetScalerMicrosoftVMwareActive DirectoryVMware vCenter
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.
- ProtocolDNS · Domain Name SystemThe internet's phone book: it turns names like example.com into the addresses computers connect to.
- TechnologyActive DirectoryMicrosoft's directory of users, computers and permissions that most corporate Windows networks are built on.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.