Unauthenticated RCE Attempt Against NetScaler ADC/Gateway (CVE-2026-88771)

Arnold Chan@slaz

•updated Sep 27, 2026•2•0•13

Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.