Citrix NetScaler Unauthenticated RCE Exploit Attempts (CVE-2026-88771)

Ibrahim Saud@tektrix

•updated Sep 28, 2026•38•0•72

Detects anomalous unauthenticated HTTP requests targeting Citrix NetScaler ADC/Gateway, characterized by suspicious URI patterns, non-standard HTTP methods, and malformed request parameters. This rule is designed to identify potential exploitation attempts consistent with CVE-2026-88771.