NetScaler VPN/ICA Session Without Prior AAA Authentication

Ibrahim Saud@tektrix

•updated Sep 28, 2026•7•0•22

Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.