NetScaler ADC/Gateway flaws actively exploited
Critical vulnerabilities in NetScaler ADC and Gateway products are being actively exploited, enabling unauthenticated attackers to leak sensitive information or cause denial of service.
Sourceipa.go.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Japan Information-technology Promotion Agency (IPA) issued an alert regarding multiple critical vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) network appliance products. These vulnerabilities allow unauthenticated remote attackers to exfiltrate sensitive information or launch denial-of-service attacks against affected systems.
Active exploitation of these vulnerabilities has been confirmed in the wild, prompting urgent warnings from IPA that the impact may expand significantly. The agency emphasizes immediate patching is required to mitigate risk. NetScaler ADC and Gateway version 12.1 has reached end-of-life status and is no longer supported.
Citrix has released patched versions addressing these vulnerabilities. Organizations running affected NetScaler products should immediately upgrade to the latest versions provided by the vendor to prevent compromise. The IPA Security Center notes they cannot answer questions about individual systems and recommends contacting product vendors directly for environment-specific guidance.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231023-2.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs