🚨 One weird historical NetScaler hit we’re keeping an eye on: On 17 Sep, a single IP hit one of our NetScaler sensors with GET /saml/login?SAMLRequest=... using UA probe/1. The request URL/base64/DEFLATE decodes from ~2.8 KB to exactly 63,488 bytes (0xF800 / 62 KiB), but the output is not XML. It’s ~59.9 KB of G, ~2.5 KB of high-entropy binary, then 1 KB of g. We searched across production for the IP, /24, UA and payload family: zero matches. That does not prove CVE-2026-88779, but now that 88779 is confirmed as a remotely reachable SAML memory-overflow issue, a one-off pre-disclosure probe apparently targeting the pre-XML decompression/memory path is hard to ignore. No known public scanner or PoC matches it so far. #citrix #netscaler #threatintel #poc

🚨 We've been tracking the NetScaler exploitation activity across our deception network since the recent disclosures, and the picture developing is bigger than individual CVEs. We're currently seeing three distinct layers of activity. CE-2026-88771 has moved rapidly from vulnerability validation into operational exploitation. Across our sensors we've observed 26 distinct exploitation sources and more than 1,750 exploit-bearing requests, progressing from simple canary commands to payload retrieval, FreeBSD-aware execution chains and webshell deployment. Separately, the earlier CVE-2026-88772 campaign demonstrates what successful compromise can lead to: purpose-built post-exploitation tooling designed for persistent access and movement beyond the appliance. The third layer is particularly interesting. We're observing separate infrastructure actively scanning internet-facing NetScaler systems for known post-compromise artefacts: hidden receiver files, CSS-disguised webshell routes and authenticated command channels. Some of that scanning predates the public technical documentation we've been able to identify. We're holding back the associated infrastructure and authentication artefacts while we validate the timeline and share the findings privately with the relevant researchers. There's also a question we're investigating separately. The mass 88771 exploitation traffic carries attacker-controlled content through NetScaler's authentication processing. watchTowr showed that nsaaad handles this content before the vulnerable Perl script does. At the same time, administrators with SAML-configured appliances are reporting nsaaad crashes with command-injection-shaped payloads visible in the authentication flow immediately beforehand. That raises a hypothesis: the same exploitation traffic reaching two independent code paths, one causing the known RCE and the other triggering a configuration-dependent failure in AAA processing when SAML is present. We haven't confirmed that causal link. But if it holds, it would mean patching for 88771 alone doesn't address the full exposure on SAML-configured appliances, and that the volume of mass exploitation traffic is itself a contributing factor to the reported instability. We're watching for the crash trigger details to test this against our retained payloads. The interesting story here isn't simply that NetScaler is being exploited. It's the ecosystem forming around compromised edge infrastructure: initial access, mass exploitation, payload deployment, persistence and then separate infrastructure searching the internet for appliances that may already contain implants. More to come once we've validated the remaining pieces. #citrix #threatintel #poc #NetScaler