CISA wants NetScaler owners to check for intruders before installing Citrix's zero-day fixes

"We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately," one administrator wrote on Reddit, in a post reported by BleepingComputer and quoted by TechRadar ^[12]. Citrix had not yet gone public when those calls started ^[14]. The person reading that message had been told to switch off the box the company's staff use to reach internal networks ^[2], with no details to pass on to the managers who would hear from the people locked out.

Teams usually tell themselves that a gateway fix can wait for the next maintenance window, and that the ticket closes when the build number changes. The reporting on these two flaws points the other way. A pre-notification attributed to the Dutch National Cyber Security Centre said Citrix found the flaws while investigating incidents at customers, Lawrence Abrams reported for BleepingComputer, and NCSC-NL declined to confirm the notice ^[13]. Security researcher Kevin Beaumont wrote that the attacks have run all month, describing the attackers as "probably nation state aligned" ^[11]. Citrix has not said who is behind them ^[11]. Its bulletin says only that exploits "on unmitigated NetScaler deployments have been observed" ^[6].

If Beaumont's timeline is right, an upgrade this week closes a hole that was open for weeks ^[11]. The upgrade does not show whether anyone came through it, and CISA warns it can wipe the traces that would ^[15]. The check also falls on the kind of device teams watch least. TechRadar notes that organisations usually put extensive security tools on computers and servers and leave specialised networking appliances less monitored ^[19]. For many teams, whatever evidence exists may sit mostly on the gateway itself ^[19].

Waiting has its own cost. "CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally," the agency said in an alert ^[8]. Each hour spent capturing an appliance's state is an hour it stays reachable on a vulnerable build.

I'd sort appliances on two axes. One is whether the box ran a vulnerable build while reachable from the internet at any point this month. The other is whether anyone has captured its state yet. For an exposed box with no capture, I'd capture and then upgrade on the same day, accepting the extra exposure in exchange for knowing whether the gateway was used. Once a capture exists, the upgrade goes on immediately and the capture goes to whoever runs incident response. Appliances already on a fixed build need a confirmed build number and nothing more, captured or not. For the cloud services Citrix manages itself, Citrix is doing the upgrade, according to The Next Web ^[16].