# Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library

> Rapid7's Metasploit wrap-up (2026-11-06, release 6.5.9) adds public exploit modules for several perimeter and developer-facing products, including an unauthenticated command-injection RCE in Citrix NetScaler ADC/Gateway that is exploited in the wild and listed in CISA KEV, and a Cisco Secure Email Gateway S/MIME SQL-injection-to-root RCE. Public modules lower the barrier for opportunistic exploitation of unpatched appliances.

- **Published:** 2026-11-06T14:46:17Z
- **Last reviewed:** 2026-11-06T14:46:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5423
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5423.png
- **ID:** TL-2026-5423
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (2 shown free below)
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2026-76461, CVE-2026-76443, CVE-2026-97229, CVE-2026-25856, CVE-2026-39908, CVE-2025-58434, CVE-2024-5450

## Description

Rapid7's weekly Metasploit wrap-up published on 2026-11-06 (Metasploit Framework 6.5.9) announces 13 new modules. The highest-risk are exploit modules for network perimeter devices. (1) Citrix NetScaler ADC / Gateway unauthenticated command injection (PR #21962): the Rapid7 post lists the CVE as CVE-2026-88771 in one place and CVE-2026-88773 in the description; vendor, CISA and third-party coverage consistently identify the pre-auth command injection as CVE-2026-88771 (the companion DTLS memory-overflow flaw is CVE-2026-88772). The bug is a log-injection: attacker-controlled input such as a username on an unauthenticated login request is written to a log, and the maintenance script ns_monuploadd_err.pl (per Picus analysis) later builds a shell command from that log content using Perl backticks, so a semicolon in the payload splits the find command and the injected command runs as root. It works on default configurations. Citrix published a bulletin around 2026-09-27/28; CISA added it to KEV on 2026-09-27; watchTowr released a PoC on 2026-09-29 and mass opportunistic exploitation followed. Mandiant/GTIG observed a post-exploitation toolkit with PHP web shells (WHIPSHOT) and a Python tunneler (SLAPSHOT) in government, financial, technology, education and legal sectors; Arctic Wolf counted at least 78 affected organizations. Fixed builds reported by third parties: 14.1-73.37 and 13.1-64.23 or later (13.1.37.279 for FIPS/NDcPP).

(2) Cisco Secure Email Gateway S/MIME/email-parsing SQL injection leading to unauthenticated root RCE (PR #22018): Rapid7 cites CVE-2026-76443; BleepingComputer and others identify the actively exploited zero-day as CVE-2026-76461, with CVE-2026-76440, -76441, -20353 and -76443 patched in the same advisory with no exploitation evidence at the time. The mapping of the module to a specific CVE should be verified against the Cisco advisory (cisco-sa-esa-inj-2bLVGmhX). An attacker sends a crafted email carrying SQL statements through an affected AsyncOS gateway (also Secure Email and Web Manager); no workaround exists.

(3) GitLab CE/EE CI/CD regular-expression compiler integer overflow (CVE-2026-97229, CWE-190, CVSS 10.0; PR #22017): affects 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; fixed 2026-10-12. Rapid7 reproduced code execution on GitLab CE 19.4.1; the module requires write access to a public project (a malicious .gitlab-ci.yml with UTF-8 characters in a path). Public sources conflict on KEV listing and in-the-wild exploitation; Help Net Security stated none confirmed as of its update.

(4) Other modules: OpenBullet2 >=0.2.5 up to 0.3.2 C# execution-mode RCE (CVE-2026-25856, CVSS 8.8, authenticated per NVD though Rapid7 describes unauthenticated via an auth bypass chain) and NTLMv2 hash disclosure via UNC-path proxy source (CVE-2026-39908); Flowise <=3.0.5 unauthenticated account takeover through forgot-password token disclosure (CVE-2025-58434, CVSS 9.8); SPIP <4.4.23 password-change IDOR (no CVE stated); WordPress Bug Library plugin <2.1.1 unauthenticated PHP file upload (CVE-2024-5450, CVSS 9.1); an authenticated Portainer Docker RCE as root; and a Linux ELF payload-injection persistence module. No threat actor is attributed to the Metasploit release itself. Initial NetScaler CVE-2026-88772 exploitation was suspected state-sponsored espionage, while CVE-2026-88771 exploitation is mass opportunistic activity.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1610 Deploy Container
- T1505.003 Server Software Component: Web Shell
- T1554 Compromise Host Software Binary
- T1036 Masquerading
- T1187 Forced Authentication
- T1005 Data from Local System
- T1090 Proxy
- T1132.001 Data Encoding: Standard Encoding

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NetScaler CVE-2026-88771 Log-Injection Command Injection (doAuthentication.do) — Exploitation** (`TL-2026-5423-SPL-001`)

Detects exploitation of the unauthenticated Citrix NetScaler ADC/Gateway log-injection command injection (CVE-2026-88771, TL-2026-5423, public Metasploit/watchTowr exploit). Attacker-controlled input such as a username containing a semicolon is POSTed to /nf/auth/doAuthentication.do, written to a log, and later concatenated by the maintenance script ns_monuploadd_err.pl into a Perl backtick shell command, giving root command execution. The search fires on a semicolon-bearing username/login parameter, the 'pitboss PPE unexpectedly died NSPPE' marker string, or the ns_monuploadd_err.pl sink appearing in appliance syslog. CISA KEV listed and mass-exploited since 2026-09-29.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** netscaler:citrix:netscaler:syslog, index=netscaler
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=netscaler sourcetype=citrix:netscaler:syslog earliest=-24h ("/nf/auth/doAuthentication.do" OR "pitboss PPE unexpectedly died NSPPE" OR "ns_monuploadd_err.pl")
| eval inj_semicolon=if(match(_raw, "(?i)(username|login)=[^& ]*(;|%3B)"), 1, 0)
| eval ioc_pitboss=if(like(_raw, "%pitboss PPE unexpectedly died NSPPE%"), 1, 0)
| eval ioc_sink=if(like(_raw, "%ns_monuploadd_err.pl%"), 1, 0)
| where inj_semicolon=1 OR ioc_pitboss=1 OR ioc_sink=1
| eval src_host=coalesce(src, src_ip, "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen sum(inj_semicolon) as inj_hits sum(ioc_pitboss) as pitboss_hits sum(ioc_sink) as sink_hits by host, src_host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Citrix"
| where (RequestURL contains "/nf/auth/doAuthentication.do" and (RequestURL matches regex @"(?i)(;|%3b)" or Message matches regex @"(?i)(username|login)=[^& ]*(;|%3b)"))
    or Message contains "pitboss PPE unexpectedly died NSPPE"
    or Message contains "ns_monuploadd_err.pl"
    or AdditionalExtensions contains "ns_monuploadd_err.pl"
| project TimeGenerated, DeviceVendor, DeviceProduct, Computer, SourceIP, DestinationIP, RequestMethod, RequestURL, Message
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Citrix NetScaler CVE-2026-88771 Log-Injection Command Injection Attempt
id: 6b0c1d4e-3f52-4a7b-9c18-5e2d7a9f4b01
status: experimental
description: Detects POST requests to the NetScaler /nf/auth/doAuthentication.do endpoint carrying shell metacharacters (semicolon) in the query, or the pitboss PPE marker string, associated with the unauthenticated log-injection command injection CVE-2026-88771 (TL-2026-5423).
references:
  - https://www.picussecurity.com/resource/blog/cve-2026-88771-citrix-netscaler-pre-auth-command-injection-explained
  - https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026.88771
logsource:
  category: webserver
detection:
  selection_uri:
    cs-method: POST
    c-uri|endswith: '/nf/auth/doAuthentication.do'
  selection_inj:
    c-uri-query|contains:
      - ';'
      - '%3B'
      - '%3b'
  selection_marker:
    - 'pitboss PPE unexpectedly died NSPPE'
  condition: (selection_uri and selection_inj) or selection_marker
falsepositives:
  - Vulnerability scanners probing the NetScaler login endpoint
  - Legitimate usernames containing a semicolon (very rare)
level: high
```

**Known false positives:**

- Authorized vulnerability scanners or red-team exercises that replay the watchTowr PoC or Metasploit module against NetScaler
- Appliance syslog lines that legitimately mention ns_monuploadd_err.pl during maintenance or support diagnostics

**Tuning notes:** Point the index at the one that receives NetScaler syslog and confirm the sourcetype (citrix:netscaler:syslog from the Splunk Add-on for Citrix NetScaler). Exclude scanner source IPs via a lookup. Any hit on the pitboss marker or the ns_monuploadd_err.pl sink should be treated as probable compromise: patch to 14.1-73.37 / 13.1-64.23 and hunt for web shells.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NetScaler Pre-Auth Command Injection Indicators in CEF Logs — Exploitation (KQL) (locked: unlock with TL Creds)
- NetScaler WHIPSHOT Web Shell Paths and Masqueraded .ico/.sig Requests (KQL) (locked: unlock with TL Creds)
- NetScaler C2/Exfil Infrastructure and OpenBullet2 UNC-Path SMB Egress (KQL) (locked: unlock with TL Creds)
- Citrix NetScaler CVE-2026-88771 Log-Injection Command Injection Attempt (Sigma Primary) (locked: unlock with TL Creds)
- Citrix NetScaler Web Shell Artifacts in VPN Script and Media Paths (Sigma Primary) (locked: unlock with TL Creds)
- DNS Lookup to NetScaler Post-Exploitation Domain [indicator] (Sigma Primary) (locked: unlock with TL Creds)
- NetScaler Web Shell Staging and Masqueraded .ico/.sig Trigger Requests (WHIPSHOT) — Post-Exploitation (locked: unlock with TL Creds)
- NetScaler Post-Exploitation C2 / Exfiltration Infrastructure (httpworkbench DNS, [indicator], SLAPSHOT tunneling) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 13)

Defanged, TLP:CLEAR.

- IP address: `138.199.200[.]90`
- Domain: `instances[.]httpworkbench[.]com`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more](https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more)
- [Help Net Security: NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)](https://www.helpnetsecurity.com/?p=386203)
- [Picus Security: CVE-2026-88771 Citrix NetScaler Pre-Auth Command Injection Explained](https://www.picussecurity.com/resource/blog/cve-2026-88771-citrix-netscaler-pre-auth-command-injection-explained)
- [The Hacker News: Attackers exploit NetScaler flaw (WHIPSHOT / SLAPSHOT toolkit)](https://thehackernews.com/2026/09/attackers-exploit-netscaler-flaw-for.html)
- [SOCRadar: NetScaler C2 and CVE-2026-88771 exploitation kit](https://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/)
- [BleepingComputer: New Cisco Secure Email zero-day exploited to execute commands as root](https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/)
- [Help Net Security: GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)](https://helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229)
- [Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)](https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229)
- [NVD: CVE-2025-58434 (Flowise)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-58434)
- [Flowise GitHub Security Advisory GHSA-wgpv-6j63-x5ph](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph)
- [NVD: CVE-2024-5450 (Bug Library)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-5450)
- [NVD: CVE-2026-25856 (OpenBullet2 RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25856)
- [VulnCheck: OpenBullet2 NTLMv2 hash disclosure via UNC path proxy source (CVE-2026-39908)](https://www.vulncheck.com/advisories/openbullet2-ntlmv2-hash-disclosure-via-unc-path-proxy-source)
- [Metasploit Framework repository](https://github.com/rapid7/metasploit-framework)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5423