#netscaler

6 articles

The NetScaler appliances restarting after the patch were not a patch bug — they were a third zero-day, and the sixth crash is the trigger

2026-10-06Security

On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.

The NetScaler build that stopped the exploitation is restarting the gateway, and the bulletin that told you to install it says nothing about it

2026-10-03Security

Citrix shipped 14.1-73.37 for two actively exploited 9.5s. Customers who installed it are reporting repeated appliance reboots, traced to crafted SAML traffic crashing the authentication service until the watchdog restarts the box. Citrix says it is tracking a newly seen SAML issue. Bulletin CTX697096, last updated 27 September, still does not mention it.

The NetScaler web shell answers a request for a missing icon, and CISA says hunt before you patch

2026-10-01Security

Mandiant's analysis of two Citrix NetScaler zero-days describes root access won through a DTLS handshake on UDP 443, then an appliance reconfigured so that a request for a missing interface icon returns a PHP web shell inside a 404. The persistence it leaves behind survives the update, which is why CISA's alert asks organisations to look for compromise first.

The ransomware crew skipped Cisco's 10.0. It logged in with the 5.3 that CISA listed back in July

2026-09-12Security

CISA gave agencies until 12 September to deal with exploited flaws in Cisco's firewall manager, Citrix NetScaler and FortiOS. Talos's research shows the Qilin-linked cluster ignored the CVSS 10.0 bypass and used a hard-coded password flaw CISA had listed in July — and the federal instruction for all of it starts with evidence, not the patch.

Citrix called it a denial of service. Researchers showed it was unauthenticated code execution

2026-08-29Security

CVE-2026-8452 was patched on 30 June with an advisory describing unpredictable behaviour and DoS. WatchTowr published proof it gives unauthenticated remote code execution, and attackers were dropping web shells within days. CISA added it to KEV on 26 August with a three-day deadline. The patch existed for two months.

A CVSS 9.3 authentication bypass in NetScaler, no exploitation yet, and every reason to treat that as temporary

2026-08-21Security

CVE-2026-19490 lets a remote unauthenticated attacker walk past authentication on NetScaler appliances configured as a gateway or AAA virtual server. Nothing has been seen in the wild. Rapid7's advice is to patch on an emergency basis anyway, and NetScaler's history is the argument.