CISA Warns of Exploited Flaws in Citrix Remote-Access Devices

The Cybersecurity and Infrastructure Security Agency ("CISA") warned that attackers were actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway devices, which manage remote access to internal networks.

In the alert, CISA said that Citrix disclosed eight new vulnerabilities in the products and that the agency added two of them to its Known Exploited Vulnerabilities Catalog after confirming the flaws were being exploited worldwide. CISA said both vulnerabilities can independently enable remote code execution. NetScaler devices typically sit at the edge of a corporate network, managing connections between outside users and internal applications. CISA said updating NetScaler deployments can be complex and may require downtime.

CISA told users and administrators to review Citrix's advisories and, where possible, to check for indicators of compromise before applying updates. The agency said organizations suspecting compromise should preserve forensic evidence first because updates may result in loss of forensic visibility.

CISA said it issued the alert to help organizations assess exposure, prioritize mitigation, and account for the vulnerabilities in their risk-management activities.