Memory Overflow in Citrix NetScaler ADC and Gateway

Successful exploitation can compromise the integrity of an affected NetScaler appliance by producing unintended control flow and can disrupt availability through a denial-of-service condition. Exploitation against unmitigated appliances was observed before public disclosure. Investigations of affected organizations also identified malicious web shells and anti-forensic activity, so patching alone may not remove access already established on a compromised appliance.

Prioritize immediate patching of internet-exposed appliances configured with Gateway functions or AAA virtual servers. Until remediation is complete, restrict access to the affected services using network-level controls where operationally feasible. Review affected appliances for evidence of compromise, including through available vendor and national cyber-security-center forensic checks. If compromise is suspected, preserve relevant evidence, isolate the appliance as appropriate, investigate connected systems, invalidate active sessions, and rotate credentials, secrets, certificates, and private keys that may have been exposed. Patching does not evict an attacker who obtained persistent access before remediation.

Upgrade NetScaler ADC and NetScaler Gateway deployments to 14.1-47.46 or later, 13.1-59.19 or later, or NetScaler ADC 13.1-FIPS/NDcPP 13.1-37.236-FIPS/NDcPP or later. Replace end-of-life 12.1 and 13.0 deployments with supported releases, because supported security updates are unavailable for those versions. Following remediation, perform compromise assessment and incident response where exposure or exploitation is suspected.