Threat video1:00
Metasploit 6.5.9 NetScaler RCE Module: Detection & IOCs
Metasploit 6.5.9 ships CVE-2026-88771, an exploited Citrix NetScaler RCE, plus other public modules; 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Metasploit 6.5.9 NetScaler RCE Module: Detection & IOCs →
Chapters
- 0:00The hookMetasploit ships 13 public exploit modules.
- 0:04The storyIn September, a PoC exploited NetScaler.
- 0:11Attack pathResearchers reproduced improper validation in an unauthenticated login request on NetScaler.
- 0:27AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise8 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Patch Citrix NetScaler ADC/Gateway.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Metasploit ships 13 public exploit modules.
0:05In September, a PoC exploited NetScaler.
0:08Today Metasploit ships 13 public modules.
0:12Researchers reproduced improper validation in an unauthenticated login request on NetScaler.
0:18The injected command runs as root, implanting a shell.
0:22Attacker establishes control and exfiltrates data.
0:28No threat actor: this was defensive research.
0:328 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
0:3811 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Patch Citrix NetScaler ADC/Gateway.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.