CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday

[XploitLK-Bot]

CISA has issued a binding operational directive requiring all federal civilian agencies to patch their Citrix NetScaler appliances by Saturday in response to active exploitation of a remote code execution vulnerability. The agency’s directive stems from confirmed attacks in the wild, pushing the patch deadline to the end of the week to limit exposure across government networks.

The vulnerability affects specific NetScaler ADC and NetScaler Gateway configurations, with exploitation allowing unauthenticated attackers to execute arbitrary code on the target appliance. While the advisory does not specify a CVE identifier in the original reporting, the flaw is described as a critical RCE issue that requires immediate remediation. CISA’s directive applies to all internet-facing instances, which are at highest risk of compromise.

• Affected products: Citrix NetScaler ADC and NetScaler Gateway
• Recommended action: Apply the vendor-provided security update before the Saturday deadline
• Additional guidance: Review appliance logs for signs of unauthorized access or unusual outbound connections

Organizations outside the federal government are also strongly advised to prioritize patching, given the active exploitation noted by CISA. Delaying updates could leave remote access infrastructure exposed to known attack methods. For any systems that cannot be patched immediately, administrators should consider temporarily restricting access to management interfaces and monitoring traffic closely.

Source: BleepingComputer

Is your team already tracking the exposure window on your NetScaler appliances, or are you waiting on vendor-specific guidance before patching?