Citrix patches three NetScaler flaws, one exploited in the wild

Citrix on Aug. 26 released emergency patches for three high severity vulnerabilities in its NetScaler Application Delivery Controller and NetScaler Gateway products, warning that one of the flaws is being actively exploited in the wild and urging customers to upgrade immediately. The bugs, tracked as CVE20257775, CVE20257776 and CVE20258424, can allow remote code execution, denial of service and improper access to management interfaces on affected appliances, Citrix said.

The most urgent flaw, CVE20257775, is a memory overflow vulnerability rated 9.2 on the CVSS scale that can lead to remote code execution or denial of service when NetScaler is configured in certain roles, including as a Gateway VPN or AAA virtual server, ICA Proxy, CVPN, RDP Proxy, or in load‑balancing configurations bound to IPv6 services. Citrix said exploits of CVE20257775 on unmitigated appliances have been observed and that no mitigations or workarounds are available, only firmware updates to patched releases.

Independent scanning and threat monitoring produced differing snapshots of exposure. The Shadowserver Foundation and other researchers reported more than 28,200 internet‑accessible Citrix instances...