Citrix NetScaler ADC and NetScaler Gateway (all versions prior to patched releases)
NetScaler ADC (Application Delivery Controller) and NetScaler Gateway are Citrix networking appliances used by organisations to manage, secure, and control access to internal applications — often sitting at the edge of a corporate network as a gateway for remote workers.
Root Cause
The flaw exists in a code path that can be reached without authentication. Think of it like a side entrance to a building that has no lock and no guard — the main door requires a keycard, but this entrance bypasses all of that. The developer failed to enforce authentication checks before reaching the vulnerable function.
Attack Vector
An attacker with network access to the appliance sends a specially crafted request. No credentials are required. The request reaches the vulnerable code and allows the attacker to execute commands with the privileges of the running service. From there, moving through the internal network to reach other systems becomes straightforward.
Detection Notes
Check NetScaler logs for unexpected read operations or API calls from unfamiliar IP addresses. Look for unusual process spawning on the appliance. Review any recent configuration changes made outside normal change windows.
Recommended Actions
- Apply Citrix's patches immediately — this is actively exploited and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.
- If patching is not immediately possible, take the appliance offline until it can be patched, as several administrators were advised to do.
- Review Citrix's published indicators of compromise (IoCs — specific technical signs that a system has been attacked) before patching, per CISA's guidance.