Two Unpatched Citrix NetScaler Zero-Days Reportedly Exploited in the Wild
Summary
watchTowr says two unpatched NetScaler flaws enabling remote code execution are being exploited. Citrix has not confirmed them or released a fix; administrators are advised to isolate appliances and preserve evidence if compromise is suspected.
Key points
- watchTowr reported two unpatched remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway, allegedly exploited in the wild.
- Citrix had not confirmed the flaws or published a patch, workaround, or indicators of compromise as of Sunday morning.
- watchTowr said the vulnerabilities were found during forensic investigations but named no victim and published no supporting evidence.
- Some administrators reportedly took appliances offline after receiving shutdown advice; the warning’s source was not established.
- Citrix guidance for suspected compromise recommends preserving evidence, isolating the appliance, rotating stored and user credentials, and revoking certificates and private keys.
- A fix may not establish whether attackers accessed an appliance before patching; NetScaler 13.1 had reached End of Maintenance, and Citrix had not clarified its patch coverage.
Article Details
- Vulnerability Types
- Remote code execution
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Isolate affected appliances from the network or shut them down while awaiting a fix.
MITRE ATT&CK
CVE
Vendors
Products
NetScaler ADCTwo newly uncovered, unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, according to watchTowr.NetScaler GatewayTwo newly uncovered, unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, according to watchTowr.