NetScaler ADC/Gateway RCE flaws under active exploitation
Critical vulnerabilities in NetScaler ADC/Gateway enable remote code execution and DoS; active exploitation observed, immediate patching required.
IPA Japan has issued a security alert for multiple critical vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) network appliance products. The vulnerabilities allow remote attackers to execute arbitrary code and launch denial-of-service attacks against vulnerable systems.
Active exploitation of these vulnerabilities has been confirmed in the wild, with IPA warning that damage is expected to escalate. The vendor has released patched versions to address the security issues. Notably, NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 have reached end-of-life status and are no longer supported.
Organizations running affected NetScaler products are urged to apply updates immediately. The criticality stems from the combination of network-facing exposure typical of these gateway appliances, the severity of potential impact (remote code execution), and confirmed active exploitation by threat actors.
Detection guidance
Suspicious Child Process Spawned by NetScaler HTTP/Management Daemon
Detects shell or scripting interpreters spawned by NetScaler ADC/Gateway HTTP daemon processes (nsppe, httpd, aslearning), indicative of post-exploitation command execution following RCE against the appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from NetScaler Daemon
id: 358a6063-7741-5a35-954a-65f16f720e76
status: experimental
description: Detects shell/interpreter processes spawned by NetScaler ADC/Gateway
service processes (nsppe, httpd, aslearning), consistent with active exploitation
of NetScaler RCE vulnerabilities where attackers gain command execution through
the vulnerable web-facing service.
references:
- https://www.ipa.go.jp/
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- nsppe
- httpd
- aslearning
- nsaaad
suspicious_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
condition: selection and suspicious_child
falsepositives:
- Legitimate administrative scripts or health-check utilities invoked by NetScaler
management processes
- Vendor-supplied diagnostic or support bundle collection scripts
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
Webshell File Written to NetScaler Web-Accessible Directory
Detects creation of script files (php, pl, cgi, jsp) in NetScaler web-accessible directories by the HTTP daemon process, a common post-exploitation step after successful RCE against NetScaler ADC/Gateway. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell Dropped in NetScaler Web Directory
id: 5cb4c34e-dcea-550d-9fef-b1d63637aa3f
status: experimental
description: Detects file writes of common webshell script extensions into NetScaler
ADC/Gateway web-accessible directories, consistent with attackers dropping a webshell
after exploiting a NetScaler RCE vulnerability to gain persistent access.
references:
- https://www.ipa.go.jp/
logsource:
category: file_event
product: linux
detection:
selection:
Image|contains:
- nsppe
- httpd
TargetFilename|contains:
- /netscaler/ns_gui
- /var/vhost
- /netscaler/portal
TargetFilename|endswith:
- .php
- .pl
- .cgi
- .jsp
- .jspx
condition: selection
falsepositives:
- Legitimate custom portal theme or extension deployment by administrators
- Vendor patch or firmware update process writing script files to the same directories
level: high
tags:
- attack.t1190
- attack.persistence
author: Vorant
Outbound Connection Initiated by NetScaler Service Process to External Host
Detects the NetScaler HTTP/management daemon process initiating outbound network connections, which is atypical for this service and may indicate a reverse shell or C2 callback following successful exploitation of a NetScaler RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NetScaler Daemon Initiating Outbound Network Connection
id: db6f56f8-b918-5a87-b902-1effdec26b63
status: experimental
description: Detects NetScaler ADC/Gateway service processes (nsppe, httpd, aslearning)
making outbound network connections, which is unusual for these processes and may
indicate a reverse shell or command-and-control callback established after exploitation
of a NetScaler RCE vulnerability. This should be tuned to exclude the appliance's
known management/update destinations.
references:
- https://www.ipa.go.jp/
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- nsppe
- httpd
- aslearning
Initiated: 'true'
filter:
DestinationPort:
- 443
- 80
DestinationHostname|contains:
- citrix.com
- cloud.com
condition: selection and not filter
falsepositives:
- Legitimate NetScaler telemetry, license check-in, or firmware update traffic to
vendor cloud endpoints
- Configured outbound health-check or monitoring integrations
level: medium
tags:
- attack.t1190
- attack.command-and-control
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20250827.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free