Noticed this new option in the AAA WAF protection settings for “portal endpoints” but idk what this is referencing. Is it like the page for RDP proxy with bookmarks? Anyone know?

Yes, that is exactly it. Until now, WAF protection on NetScaler AAA/Gateway covered only the entry points: authentication flows and VPN tunnel establishment. The portal interface itself (bookmarks, RDP proxy pages, self-service flows) ran without any application layer filtering, so it relied on firmware patching alone. The new Portal option closes that gap by routing all post-login HTTP traffic through a dedicated AppFW profile. Application level attacks such as XSS or command injection are blocked before the request ever reaches the underlying portal scripts. In short, protection now extends from the front door to the entire surface area of the Gateway user experience.

Ok awesome, thank you!