CVE-2026-88771 and CVE-2026-88772 Citrix ADC Gateway Exploitation Sequence

Arnold Chan@slaz

•updated 28 days ago•4•0•24

Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.