Act
archived
Citrix NetScaler Pre-Auth RCE Exploited; Web Shells Hidden in CSS-Like URLs
- Engineer — Act: Active exploitation of a critical pre-authentication command injection flaw in NetScaler ADC/Gateway is confirmed across multiple environments. Patch NetScaler immediately, audit for newly created superuser accounts, and scan access logs for web shell requests disguised as CSS resource paths.
- SOC/IR — Act: The campaign leaves distinctive artifacts: superuser account creation and web shells mapped to CSS-mimicking URL patterns to evade detection. Hunt for anomalous local account additions on NetScaler appliances and review NetScaler access logs for CSS-like paths that return interactive responses since at least early October 2026.
- Leader — Act: Active, multi-victim exploitation of a widely deployed VPN/ADC edge device with configuration data theft is board-level exposure. Confirm NetScaler presence in your environment, verify patch status with your infrastructure team this week, and assess whether stolen config data — credentials or certificates — warrants customer or auditor notification.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.