High-volume unauthenticated POST scanning of NetScaler VPN/Nitro endpoints

Ibrahim Saud@tektrix

•updated Sep 28, 2026•1•0•9

This rule detects anomalous, high-frequency unauthenticated POST requests targeting NetScaler ADC and Gateway management or service endpoints (/vpn/, /logon/, /nitro/). Such patterns are characteristic of automated reconnaissance and exploitation attempts, specifically targeting vulnerabilities like CVE-2026-88771 and CVE-2026-88772.