Citrix NetScaler Critical Auth Bypass in Gateway and AAA Configs

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Plan: A critical auth bypass in NetScaler ADC/Gateway is high-severity exposure for any org using these as VPN or AAA endpoints; no KEV listing or public PoC in signals, so patch to the latest Citrix-released version this cycle rather than emergency response.
SOC/IR — Learn: No active exploitation or IOCs reported yet; monitor for KEV addition or PoC release, at which point an assume-breach sweep of edge authentication logs would be warranted.
Leader — Skip

Citrix warns of two NetScaler Gateway and ADC vulnerabilities

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Plan: NetScaler Gateway and ADC are widely deployed edge appliances with a strong exploitation history; apply Citrix’s patches within your next maintenance window and verify no unpatched instances are internet-facing. No KEV listing or public PoC present to justify emergency patching, but Citrix’s urgency language warrants prioritizing this over routine patching cycles.
SOC/IR — Learn: No active exploitation, IOCs, or TTPs reported yet; file this as context in case exploitation emerges, given NetScaler’s track record as a high-value target. Monitor threat intel feeds for follow-on exploitation reports before building detections.
Leader — Skip