NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Reported 20 Oct 2026 by otx · Severity: medium

In early October 2026, analysts investigated a compromise of a Citrix NetScaler ADC appliance running an affected 14.1 build. Attackers chained two vulnerabilities: CVE-2026-88771 (pre-authentication log-poisoning/RCE) and CVE-2026-88779 (SAML-parsing crash) to achieve root code