Unauthenticated Remote Command Execution in Citrix NetScaler ADC and Gateway

An unauthenticated attacker able to reach an affected appliance can execute arbitrary commands, resulting in full compromise of the NetScaler system at the privilege level of the vulnerable service. Compromise of an internet-facing edge appliance can establish an initial foothold and enable persistence, credential theft, collection of appliance configuration and authentication data, and lateral movement into connected environments. Applying an update prevents further exploitation but does not remove attacker persistence or artifacts from an earlier compromise.

There is no indicated feature-specific workaround because the vulnerability affects default NetScaler ADC and Gateway deployments without optional functionality enabled. Until updates can be installed, reduce or remove untrusted network exposure to affected appliances, restrict access to trusted administrative and required client networks, and monitor externally collected appliance logs and file-integrity alerts for evidence of compromise. Treat previously internet-exposed unpatched appliances as potentially compromised; preserve logs and memory evidence before remediation where feasible.

Urgently upgrade all affected Citrix NetScaler ADC and Gateway nodes to version 14.1-73.37 or later, or 13.1-64.23 or later, as applicable. Upgrade FIPS deployments to 14.1-73.37 FIPS or later and FIPS/NDcPP deployments to 13.1-37.279 or later. Verify the running build on every appliance node after upgrading. For deployments with NetScaler variables configured, assess upgrade guidance carefully because version 13.1-64.23 can enter a reboot loop in that condition; plan to upgrade to 13.1-64.24 where applicable. Conduct compromise assessment and incident response for systems exposed before patching, including preservation of relevant evidence, review of authentication and network activity, and investigation of unexpected processes, files, configuration changes, and outbound connections.