Citrix Discloses Pre‑Patch Exploitation of Two Critical NetScaler Zero‑Days

Citrix Systems announced that two high‑severity zero‑day vulnerabilities affecting its NetScaler ADC and NetScaler Gateway appliances were actively leveraged by attackers before security patches were made available.

The flaws permit unauthenticated remote code execution, allowing threat actors to run arbitrary commands on vulnerable devices. Security researchers identified that the vulnerabilities could be triggered over the network without any prior access, effectively giving attackers full control of the compromised appliance.

Citrix first became aware of the exploitation after receiving reports from multiple customers and third‑party security firms. The company confirmed that the attacks were occurring in the wild and subsequently released emergency patches, but only after the vulnerabilities had already been abused.

NetScaler products are widely deployed to provide load balancing, application delivery, and secure remote access for enterprises, government agencies, and service providers. Compromise of these appliances can expose internal applications, steal credentials, or serve as a foothold for further intrusion, raising concerns across sectors that rely on the technology for critical infrastructure.

In response, Citrix urged administrators to apply the newly issued updates immediately and, where patching could not be performed at once, to enable recommended mitigations such as disabling vulnerable services and restricting network access to the appliances.

The incidents underscore a growing trend of zero‑day attacks targeting network and application delivery controllers, which are often overlooked in traditional vulnerability management programs. Attackers increasingly focus on these high‑value, always‑on devices because a successful breach can bypass many downstream security controls.

Security analysts are monitoring the situation closely, expecting additional advisories and possibly attribution efforts as more details emerge. Organizations are being advised to review logs for unusual activity, verify that the latest patches are installed, and consider supplemental controls like network segmentation and multi‑factor authentication for remote access.

While the rapid release of patches demonstrates a coordinated effort between Citrix and the security community, the episode serves as a reminder that timely patch management and layered defenses remain essential to protect against sophisticated exploits that surface before vendors can issue fixes.