Citrix NetScaler Under Active Attack: Three Critical Flaws, Five Serious Bugs Patched

En bref

• Three high-severity and five additional significant bugs affect Citrix NetScaler.
• Threat actors are already leveraging these flaws in the wild.
• Vendor updates were published on Sunday, September 28, 2026.
• School districts and public agencies relying on NetScaler face elevated risk.
• Apply patches without delay and monitor for compromise.

Malicious actors are currently taking advantage of flaws in Citrix NetScaler, a widely used application delivery controller. The vendor has pushed out a security update that addresses eight distinct issues: three rated as critical and five as serious. The disclosure came on Sunday, September 28, 2026, indicating urgency.

Organizations that rely on NetScaler for remote access, load balancing, or gateway functions are at risk. This includes K-12 school districts and government agencies, which often use such appliances to support remote learning and administrative services. Because exploitation is already happening, unpatched systems could be compromised quickly.

The fact that attackers are actively exploiting these vulnerabilities elevates the threat. Even though the overall severity is assessed as medium, the presence of critical flaws and in-the-wild attacks means that a targeted incident could have significant operational impact. Schools and public sector entities are attractive targets due to limited security resources.

Citrix has not published CVE identifiers in the available information, which may complicate tracking. However, the patch release is the primary mitigation. IT teams should treat this as a priority: inventory NetScaler instances, apply the update, and monitor for signs of compromise.

What to watch: follow Citrix advisories for updated guidance, check for indicators of compromise, and ensure that any internet-facing NetScaler is patched immediately. Given the Sunday timing, attackers may have had a head start. Review logs for unusual activity and consider temporary mitigations if patching cannot be done right away.

À faire maintenant

1. Immediately inventory all Citrix NetScaler instances in your environment, including virtual and physical appliances.
2. Apply the latest security patches from Citrix without delay, prioritizing internet-facing systems.
3. If patching is not immediately possible, implement temporary mitigations such as restricting access or disabling vulnerable features as recommended by Citrix.
4. Review logs for signs of exploitation, focusing on authentication attempts, unusual outbound connections, and unexpected configuration changes.
5. Enable multi-factor authentication and strong access controls on NetScaler management interfaces.
6. Monitor Citrix advisories and threat intelligence for updates on the exploited vulnerabilities.
7. Conduct a post-patch verification to ensure updates are installed and systems are not compromised.

Source originale

The Register — Security