CVE-2026-3055 Citrix NetScaler Exploit Attempt

Ethan Andrews@eandrews

•updated Mar 30, 2026•13•0•175

Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.