NetScaler intrusion report describes persistence and reconnaissance
The analysis describes appliance compromise, persistence, internal reconnaissance and configuration theft.
The analysis describes post-exploitation activity on NetScaler appliances involving root code execution, persistent access, internal reconnaissance and theft of configuration material.
The reported intrusion included web shells, outbound command-and-control and tunnelling. The investigation also describes attempts to maintain access through reboots and across a high-availability appliance pair.
The reconnaissance covered directory services, management infrastructure and virtualization systems. The report describes configuration and key material being taken from affected appliances.
These findings document the intrusion's operational lifecycle. Readers can consult the linked analysis for the investigation details and vulnerability context.
Referenced vulnerabilities
Sources
- Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Primarywww.rapid7.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning