Citrix releases updates for two exploited NetScaler zero-days

The affected releases include NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, along with specified FIPS and NDcPP builds. Secure Private Access Hybrid deployments that use NetScaler instances also need the fixed versions.

Private warnings preceded the public patches

Administrators began reporting that suppliers, incident responders and national cybersecurity agencies were privately advising organizations to shut down appliances. BleepingComputer says Citrix discovered the vulnerabilities while investigating incidents in customer environments, prompting advance warnings so teams could prepare for disruptive upgrades.

NetScaler appliances often sit at the edge of corporate networks and provide remote access, which makes a compromise a potential path into internal systems. Citrix says its bulletin applies to customer-managed appliances. Cloud Software Group is updating Citrix-managed cloud services and Adaptive Authentication itself.

Organizations should install the fixed builds as soon as possible and reduce internet exposure where an immediate upgrade is not possible. Applying the patch addresses the vulnerability; teams that may have been exposed before patching still need to investigate for signs of compromise.