New vulnerabilities in Citrix Netscaler allow for code execution

Administrators of Citrix Netscaler instances should update their devices immediately. According to several sources, two new exploits (zero-days) are circulating, allowing code injection on vulnerable devices. The manufacturer has not commented, and there are no warnings from cybersecurity authorities. However, patches are now available and should immediately be deployed – Netscaler vulnerabilities are often exploited for cybercrime.

One of the warnings comes from the threat intelligence company watchTowr. It states: “Two vulnerabilities – both RCE. Unpatched, 0days. Exploited in the wild – discovered during forensics.” Citrix is supposedly working on an official statement and patches, which are expected by the beginning of the week.

Users on Reddit confirm this account. A supposed Citrix customer writes that the manufacturer confirmed the vulnerabilities upon inquiry and that developers are working around the clock to fix them. British…