Loading story…
Citrix released security updates for NetScaler Console and NetScaler Agent to fix CVE-2024-12284, a high-severity flaw with a CVSS score of 8.8. The vulnerability stems from improper privilege management and could let an authenticated attacker with access to a vulnerable system escalate privileges and execute commands remotely. Citrix published the issue through its support bulletin and a NetScaler security update, while national defenders including CSIRT.SK warned that organizations running local deployments should treat the issue as urgent.
Affected releases include NetScaler Console and NetScaler Agent 14.1 versions earlier than 14.1-38.53 and 13.1 versions earlier than 13.1-56.18. Citrix said its managed solutions had already been secured, but customer-managed instances require patching and hardening. Organizations were advised to upgrade immediately to 13.1-56.18, 14.1-38.53, or later, and to follow NetScaler Console secure-deployment best practices to reduce exposure.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Citrix stated that Citrix-managed solutions were already secured against CVE-2024-12284, while customer-managed instances still required patching. The advisory recommended upgrading affected 13.1 and 14.1 versions to fixed releases and following hardening guidance.
Citrix issued security updates for NetScaler Console and NetScaler Agent to remediate CVE-2024-12284, a high-severity improper privilege management flaw with CVSS 8.8. The vulnerability could let an authenticated attacker escalate privileges and execute commands remotely on vulnerable systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcenetscaler.com
Open sourcesupport.citrix.com
Open sourcedocs.netscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026
Citrix patched three critical vulnerabilities in on-premises **NetScaler ADC** and **NetScaler Gateway** appliances: `CVE-2025-7775`, `CVE-2025-7776`, and `CVE-2025-8424`. Citrix reported active exploitation of `CVE-2025-7775`, which can cause denial of service or enable arbitrary code execution; the other flaws can also enable code execution and may allow unauthorized access. The Dutch NCSC assessed the risk as **High/High**, citing widespread vulnerable deployments and the likelihood of large-scale exploitation. Citrix cloud services have been updated, while organizations operating affected on-premises appliances should urgently install Citrix fixes, apply vendor mitigations, monitor for suspicious activity, and use the NCSC's updated detection script to investigate potential compromise.
Aug 31, 2026