NetScaler New Superuser/nsroot Account Creation

Ibrahim Saud@tektrix

•updated Sep 28, 2026•18•0•16

Detects the creation or modification of a local NetScaler administrative account with superuser (nsroot-level) privileges via the appliance CLI or management API. This activity is indicative of persistent administrative backdoors potentially established after the exploitation of vulnerabilities such as CVE-2026-88771 or CVE-2026-88772.