OTX Threat: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

In early October 2026, analysts investigated a compromise of a Citrix NetScaler ADC appliance running an affected 14.1 build. Attackers chained two vulnerabilities: CVE-2026-88771 (pre-authentication log-poisoning/RCE) and CVE-2026-88779 (SAML-parsing crash) to achieve root code execution. The intrusion deployed multiple persistence mechanisms including PHP web shells with cookie-based command cha CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-97229, CVE-2026-104935