Two Citrix NetScaler Zero-Days Actively Exploited, No Patch Available

En bref

• Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are under active exploitation.
• No patches or CVE identifiers exist as of September 26.
• Attackers can achieve remote code execution on vulnerable appliances.
• watchTowr issued the warning; some organizations have taken devices offline.
• Severity is high; K-12 and government agencies should prioritize mitigation.

On September 26, the security research firm watchTowr raised an alarm about a pair of zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway. Unidentified threat actors are already exploiting these flaws in the wild. As of now, Citrix has not released a fix, and no CVE numbers have been assigned.

The vulnerabilities permit remote code execution, meaning an attacker could run arbitrary commands on a compromised appliance. Because NetScaler products often sit at the network edge, they are attractive targets. In response to the active exploitation, some organizations have chosen to take their appliances offline as a precaution.

Any entity using Citrix NetScaler ADC or Gateway is potentially at risk. This includes K-12 school districts and government agencies that depend on these products for secure remote access and application delivery. The absence of a patch leaves defenders with few options beyond temporary workarounds.

Active exploitation of unpatched edge devices is a serious concern. Attackers could gain a foothold, move laterally, and access sensitive data. For the education sector, such a compromise could disrupt learning and expose student information. The lack of CVE identifiers also complicates tracking and vulnerability management.

watchTowr's warning underscores a broader trend of zero-days in network appliances. While Citrix works on a fix, organizations must rely on mitigations like taking devices offline or enforcing strict access controls. What to watch: Citrix advisories for patches and CVE assignments, plus indicators of compromise. The situation is evolving, and severity remains high.

À faire maintenant

1. Inventory all Citrix NetScaler ADC and Gateway appliances in your environment immediately.
2. If operationally feasible, take vulnerable appliances offline until official patches are released.
3. Restrict management interface access to trusted IP addresses and disable unnecessary services.
4. Enable detailed logging and monitor for signs of remote code execution or unusual outbound traffic.
5. Apply any temporary mitigations or configuration changes recommended by Citrix.
6. Subscribe to Citrix security advisories and prepare for emergency patching once fixes are available.
7. Conduct threat hunting for indicators of compromise on all NetScaler systems and related network segments.

Source originale

The Hacker News