Loading story…
Citrix and FireEye Mandiant released a forensic tool to help organizations investigate exploitation of CVE-2019-19781, a critical vulnerability affecting Citrix ADC and Citrix Gateway appliances. The Dutch National Cyber Security Centre warned that internet-facing affected systems not mitigated before public exploits emerged on 9 January 2020 should be presumed compromised.
Organizations were advised to patch affected appliances immediately, review logs back to Citrix’s 17 December 2019 disclosure, and use forensic investigation to identify compromise. Where indicators are found, responders should rebuild affected systems from clean images and rotate credentials and certificates; organizations that applied mitigations earlier should still patch and monitor for activity by advanced threat actors.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Citrix released a new patch for affected version 10.5.
Citrix released new patches for affected Citrix ADC and Citrix Gateway versions 12.1 and 13.0.
The Dutch NCSC published the first version of its advisory on patching and recovering Citrix ADC and Gateway systems affected by the vulnerability.
Public exploits became available for the Citrix ADC and Gateway vulnerability. The NCSC said systems not mitigated before this date should reasonably be presumed compromised.
Citrix published the vulnerability affecting Citrix ADC and Citrix Gateway products. The NCSC advised organizations to review logs beginning from this disclosure date during forensic investigations.
Citrix released refreshed 12.1 builds 50.28 and 50.31. The NCSC said the mitigation issue associated with the earlier 12.1 build 50.28 did not apply to these refreshed builds.
Citrix released version 12.1 build 50.28, which the NCSC later warned had an issue affecting implementation of the vulnerability mitigations.
Citrix and FireEye Mandiant shared a forensic tool for investigating CVE-2019-19781.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026
Citrix released permanent patches for the critical `CVE-2019-19781` vulnerability affecting Citrix Application Delivery Controller (ADC), formerly NetScaler ADC, and Citrix Gateway appliances. Initial fixes for versions 11.1 and 12.0 were issued on 19 January 2020, followed by final patches for versions 10.5, 12.1, and 13.0 on 23–24 January. Successful exploitation could give an unauthenticated attacker full control of an affected Citrix server and potentially provide access to connected networks. The Dutch National Cyber Security Centre urged organizations to patch according to their risk assessments, continuously monitor for exploitation, and review logs dating to 17 December 2019. Organizations that had not applied mitigations before 9 January were advised to presume compromise. Where patching was not immediately possible, the NCSC recommended restricting access through IP allowlisting, deploying a web application firewall, requiring client certificates, or taking exposed systems offline; changing an external service port was characterized only as a discovery deterrent, not an effective fix.
Aug 31, 2026
Dutch investigators found malicious webshells on Citrix NetScaler ADC and NetScaler Gateway appliances at multiple organizations following exploitation of critical 2025 NetScaler vulnerabilities. The affected flaws include `CVE-2025-5777`—an unauthenticated, remotely exploitable out-of-bounds read issue widely known as CitrixBleed 2—along with `CVE-2025-5349` and `CVE-2025-6543`; public proof-of-concept code for `CVE-2025-5777` increased the likelihood of broad exploitation. The Dutch NCSC urged organizations to immediately apply Citrix updates, investigate appliances for signs of compromise, and terminate active ICA, PCoIP, RDP, AAA, and load-balancing persistent sessions after patching. It also released forensic scripts and updated indicators of compromise for reviewing NetScaler coredumps and full appliance images, as researchers warned that exposed and unremediated devices may already have been compromised.
Aug 31, 2026