Loading story…
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to CVE-2019-19781. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure.
Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under vpns/portal/ could indicate attempted code execution, although their absence did not exclude intrusion.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The NCSC urged organizations to apply Citrix mitigations and assess exposed systems, warning that servers could already have been compromised before mitigations were deployed or where mitigations failed. It recommended specialist investigation of potentially affected systems and noted XML files in vpns/portal/ directories as possible indicators of attempted code execution.
The NCSC warned that attackers were actively searching for vulnerable Citrix ADC and Citrix Gateway servers. No active exploitation had been observed at that time, but successful unauthenticated exploitation could provide direct access to local networks and systems.
The Dutch National Cyber Security Centre had previously issued a High/High security advisory concerning the Citrix ADC and Citrix Gateway vulnerability.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcesupport.citrix.com
Open sourcesupport.citrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix patched three critical vulnerabilities in on-premises **NetScaler ADC** and **NetScaler Gateway** appliances: `CVE-2025-7775`, `CVE-2025-7776`, and `CVE-2025-8424`. Citrix reported active exploitation of `CVE-2025-7775`, which can cause denial of service or enable arbitrary code execution; the other flaws can also enable code execution and may allow unauthorized access. The Dutch NCSC assessed the risk as **High/High**, citing widespread vulnerable deployments and the likelihood of large-scale exploitation. Citrix cloud services have been updated, while organizations operating affected on-premises appliances should urgently install Citrix fixes, apply vendor mitigations, monitor for suspicious activity, and use the NCSC's updated detection script to investigate potential compromise.
Aug 31, 2026
Citrix released permanent patches for the critical `CVE-2019-19781` vulnerability affecting Citrix Application Delivery Controller (ADC), formerly NetScaler ADC, and Citrix Gateway appliances. Initial fixes for versions 11.1 and 12.0 were issued on 19 January 2020, followed by final patches for versions 10.5, 12.1, and 13.0 on 23–24 January. Successful exploitation could give an unauthenticated attacker full control of an affected Citrix server and potentially provide access to connected networks. The Dutch National Cyber Security Centre urged organizations to patch according to their risk assessments, continuously monitor for exploitation, and review logs dating to 17 December 2019. Organizations that had not applied mitigations before 9 January were advised to presume compromise. Where patching was not immediately possible, the NCSC recommended restricting access through IP allowlisting, deploying a web application firewall, requiring client certificates, or taking exposed systems offline; changing an external service port was characterized only as a discovery deterrent, not an effective fix.
Aug 31, 2026
Citrix and FireEye Mandiant released a forensic tool to help organizations investigate exploitation of **CVE-2019-19781**, a critical vulnerability affecting Citrix ADC and Citrix Gateway appliances. The Dutch National Cyber Security Centre warned that internet-facing affected systems not mitigated before public exploits emerged on 9 January 2020 should be presumed compromised. Organizations were advised to patch affected appliances immediately, review logs back to Citrix’s 17 December 2019 disclosure, and use forensic investigation to identify compromise. Where indicators are found, responders should rebuild affected systems from clean images and rotate credentials and certificates; organizations that applied mitigations earlier should still patch and monitor for activity by advanced threat actors.
Aug 31, 2026