Act
archived
Two Unpatched Citrix NetScaler RCE Zero-Days Actively Exploited
- Engineer — Act: Actively exploited RCE on NetScaler ADC/Gateway with no patch available; take appliances offline or restrict management-plane access immediately, monitor watchTowr’s advisory for IOCs and check Citrix for any interim mitigations.
- SOC/IR — Act: Active exploitation of internet-facing edge appliances means possible pre-patch compromise; assume-breach posture — hunt for anomalous activity from NetScaler IPs, review watchTowr’s analysis for TTPs, and prepare runbooks for NetScaler IR.
- Leader — Act: Unpatched RCE on a widely deployed network edge product with confirmed active exploitation is a board-level event; confirm whether NetScaler ADC or Gateway is in your estate, assess exposure, and brief leadership this week in case it escalates before a patch ships.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.