Citrix warns of new Netscaler zero-days exploited in attacks

Citrix urged customers on Tuesday to immediately patch Netscaler ADC and Gateway appliances exposed online against two actively exploited zero-day vulnerabilities. The two zero-days (tracked as CVE-2023-6548 and CVE-2023-6549) impact the Netscaler management interface and expose unpatched Netscaler instances to remote code execution and denial-of-service attacks, respectively. However, to gain code execution, attackers must be logged in to low-privilege accounts on the targeted instance and need access to NSIP, CLIP, or SNIP with management interface access. Also, the appliances must be configured as a gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server to be vulnerable to DoS attacks. The company says that only customer-managed NetScaler appliances are impacted by the zero-days, while Citrix-managed cloud services or Citrix-managed Adaptive Authentication are not affected. The list of Netscaler product versions affected by these two zero-day vulnerabilities includes the following: According to data provided by threat monitoring platform Shadowserver, just over 1,500 Netscaler management interfaces are now exposed on the Internet. ​In a security advisory published today, Citrix urged all admins to immediately patch their Netscaler appliances against the two zero-days to block potential attacks. "Exploits of these CVEs on unmitigated appliances have been observed," the company warned. "Cloud Software Group strongly urges affected customers of Net...