Anomalous NetScaler AAA/Gateway Login Requests (CVE-2026-88771)

Ibrahim Saud@tektrix

•updated Sep 28, 2026•5•0•34

Detects HTTP requests directed at NetScaler AAA or Gateway authentication endpoints that exhibit characteristics indicative of exploitation attempts against CVE-2026-88771. The rule monitors for anomalies such as excessive Content-Length headers, unusually large URI query parameters, or the presence of duplicated HTTP headers, which may be leveraged to bypass security controls or trigger buffer-related vulnerabilities during the authentication process.