By Traficom
Publication Date: 2026-10-01 00:00:00
Intrusions occurred even before Citrix released security updates on 27 September 2026. Updating the software alone may therefore not be enough. Organisations must also investigate whether their systems were compromised before the updates were installed.
According to information received by the NCSC-FI, the vulnerabilities were exploited in Finland before the security updates were released. Users of internet-facing NetScaler systems should therefore assume that their systems may have been exposed to attacks. Updating the software alone may not be enough, as an attacker may have established a persistent foothold in the environment before the patches were installed.
The NCSC-FI has identified hundreds of NetScaler instances in Finland and contacted their administrators. The NCSC-FI stresses the importance of both rapid patching and follow-up investigations, as intrusions carried out by exploiting zero-day vulnerabilities may go undetected without separate checks.
The NCSC-FI recommends…
