Memory overflow in Citrix NetScaler ADC and NetScaler Gateway

Successful exploitation can cause remote denial of service of affected NetScaler ADC/Gateway appliances and may trigger unintended control flow within the vulnerable process. Multiple advisories and secondary reporting indicate this can result in compromise of exposed appliances, with downstream consequences including unauthorized access, persistence on the device, deployment of webshells, evasion through log/trace deletion, and follow-on access into internal environments. Some reporting also states the flaw may permit arbitrary code execution, but the most conservative vendor-backed impact statement is unintended control flow and DoS.

If immediate patching is not possible, reduce exposure of Gateway and AAA virtual servers with network-level restrictions such as ACLs, firewall rules, or allowlisting. Run vendor- or NCSC-provided IOC checkscripts and review logs and forensic artifacts for signs of exploitation. Investigate unexpected crashes/coredumps, suspicious sessions, webshells, and evidence of trace deletion. If compromise is suspected, preserve evidence, isolate the appliance, collect support files and NSPPE core dumps where feasible, revoke or rotate credentials and secrets stored on or used through the appliance, invalidate active sessions, inspect connected systems for follow-on activity, and rebuild or restore from a trusted state as needed. Patching alone does not remove attacker persistence if the device was compromised before remediation.

Apply Citrix fixes immediately. Fixed versions cited in the provided content are NetScaler ADC / NetScaler Gateway 14.1-47.46 or later, 13.1-59.19 or later, and 13.1-37.236-FIPS / NDcPP or later. NetScaler 12.1 and 13.0 standard releases are end-of-life and should be upgraded to supported branches. For FIPS/NDcPP builds, Citrix support may be required to obtain the updated images. Because exploitation has been observed in the wild, patching should be followed by compromise assessment rather than treated as sufficient on its own.