NetScaler Admin Session Hijacking via Cookie Theft

Ethan Andrews@eandrews

•updated Mar 30, 2026•15•0•202

Detects potential NetScaler administrative session hijacking by monitoring for the usage of SESSID or NITRO_SK administrative cookies from multiple source IPs. Attackers leverage CVE-2026-3055 to steal these specific session cookies to gain unauthorized administrative access.