Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Excerpt
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of…
Read the original report →Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-88779 | High | Score 79/100 | First seen |
| SHA256 | 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| SHA256 | 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
| SHA256 | 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 | Medium | Score 53/100 | First seen |
| SHA256 | eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde | Medium | Score 53/100 | First seen |
| SHA256 | ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…