NetScaler Breach Analysis: How Attackers Kept Access After Reboots

Rapid7 has published details of a NetScaler ADC intrusion in which attackers chained CVE-2026-88771 and CVE-2026-88779. The new analysis explains how the attackers relaunched their malicious code after reboots and kept their access across a high-availability (HA) pair of appliances.

What’s new

The intrusion took place in early October. What the October 19 analysis adds is a reconstruction of the full attack sequence. The attackers started with crafted authentication data, which crashed a process and forced a restart, and finished by running commands with root privileges. The researchers also confirmed that the attackers stole configuration data and cryptographic material.

The report also describes additional tools the attackers used to map the internal network and relay traffic. This builds on earlier warnings that the flaws were being actively exploited, because it tells defenders what to look for after the patches are installed.

Why a reboot doesn’t end the incident

The attackers set up several ways to keep their access. According to the analysis, they also took failover between the appliances in the high-availability configuration into account. When the gateway comes back up and works normally, that alone does not show the environment is clean.

Administrators therefore need to run two separate checks: one for the vulnerabilities and one for signs of compromise. If a compromise is confirmed, they also need to work out which data and privileges the attacker could reach from the appliance.

What to do now

• Check the software versions on both appliances and apply the vendor’s current guidance for these vulnerabilities.
• Preserve logs, configuration files and any available diagnostic data before you start remediation.
• Compare your systems against the persistence artifacts and unusual connections described by Rapid7.
• If you suspect a compromise, include the second node and any internal systems reachable from the gateway in the investigation.
• Use the investigation’s findings to decide which passwords, keys and certificates need to be rotated.

SecurHUB’s take

Patching an edge device should always go hand in hand with checking whether it was compromised before the fix was applied. In incident response, the priority is to reconstruct what the attacker did and to identify which credentials and access rights need to be revoked.

Sources: Rapid7, Threadlinqs