Citrix NetScaler Unauthenticated RCE Under Active Exploitation — CISA Mandates Federal Patching by Saturday: Detection and Remediation Guide | Security Arsenal

CISA has issued an emergency directive under Binding Operational Directive 22-01 ordering all U.S. federal civilian executive branch agencies to patch their Citrix NetScaler appliances against a critical, unauthenticated remote code execution vulnerability — and the deadline is this Saturday. The flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, which means one thing for defenders: exploitation is confirmed in the wild, not theoretical.

If you run NetScaler ADC or NetScaler Gateway — federal agency or not — treat this as a patch-now, hunt-immediately event. The KEV deadline applies to FCEB agencies, but the exploitation does not discriminate by sector. Every time we have seen a pre-auth RCE land on NetScaler (and we have seen this movie before), opportunistic mass scanning and exploitation of private-sector appliances follows within days of disclosure. Your appliance is on the same internet.

Why This Is Severe

Three factors stack the severity here:

Unauthenticated remote code execution. No credentials, no valid session, no user interaction required. An attacker who can reach the appliance's management or virtual server interfaces can execute code.
The target is a perimeter device. NetScaler ADC and Gateway sit at the network edge, terminate TLS, broker authentication to internal apps, and often hold LDAP bind credentials, session cookies, and administrative sessions. Compromise of the appliance is compromise of the front door — and frequently a pivot point into the internal network.
Confirmed active exploitation. CISA KEV inclusion means threat actors are already weaponizing this. A Saturday deadline from CISA is an unusually aggressive timeline, which tells you exploitation tempo is high.

Historical precedent matters: prior NetScaler pre-auth flaws were exploited to drop webshells, steal credentials via memory scraping, and maintain persistence that survived patching. Assume that pattern holds.

Technical Analysis

Affected Products

Citrix NetScaler ADC (formerly Citrix ADC)
Citrix NetScaler Gateway (formerly Citrix Gateway)

Customer-managed appliances running vulnerable builds are affected. NetScaler-managed cloud services (Citrix-managed) are handled by the vendor, but verify your deployment model — many organizations run hybrid configurations and forget the on-prem nodes.

Check your exposure immediately with:

Bash / Shell

# From the NetScaler CLI (nscli) or via SSH to NSIP
show ns version
show ns license

# Note the build number and compare against the fixed builds
# listed in the Citrix security bulletin for this advisory

How the Attack Works (Defender's View)

Based on the reporting, the vulnerability allows an unauthenticated remote attacker to achieve code execution on the appliance via a crafted request to an exposed interface. From a defensive perspective, the exploitation chain for NetScaler pre-auth RCEs typically looks like this:

Reconnaissance — Internet-wide scanners (and targeted actors) enumerate NetScaler appliances by fingerprinting the /vpn/, /logon/LogonPoint/, and AAA vserver responses, or by TLS certificate and HTTP header fingerprinting.
Initial exploitation — A crafted HTTP(S) request to a vulnerable component triggers the code execution condition. No session or credential is required.
Payload delivery — Post-exploitation, operators typically drop webshells into the NetScaler web GUI tree (/netscaler/ns_gui/, commonly as PHP files), modify configuration via nscli, or stage payloads in writable directories like /var/ or /tmp/.
Persistence — Cron jobs on the underlying FreeBSD OS, injected config in ns.conf, rogue SAML/OAuth IdP profiles, or added local accounts.
Credential theft and pivoting — Memory scraping for admin/LDAP credentials, session token theft from the AAA process, and lateral movement into the internal network the gateway brokers access to.

Exploitation Status

Confirmed active exploitation in the wild — this is why CISA acted.
Listed in the CISA KEV catalog with a mandatory remediation deadline of this Saturday for FCEB agencies under BOD 22-01.
Expect mass scanning and automated exploitation to intensify now that the KEV listing is public.

Detection & Response

Patching is necessary but not sufficient. If the appliance was internet-facing and unpatched during the exploitation window, you must assume potential compromise and hunt before and after patching. NetScaler appliances have notoriously limited native logging — forward everything off-box.

Immediate Hunting Priorities

Webshell artifacts in the GUI tree (/netscaler/ns_gui/ — look for recently created/modified .php files with unexpected names or ownership)
Unexpected processes spawned by the web server or nsppe processes on the appliance
Outbound connections from the NetScaler to untrusted external IPs (the appliance should have a small, well-known egress profile)
New or modified cron entries, unexpected entries in /nsconfig/rc.conf, and unauthorized changes to ns.conf (new IdP profiles, responder policies, or local users)
Anomalous requests to AAA/Gateway endpoints in your WAF/load-balancer logs immediately preceding suspicious activity

Sigma Rules

These rules target the highest-fidelity observable behaviors: webshell access against NetScaler paths and suspicious child processes on the appliance. Tune the path list to your environment's baseline.

YAML

---
title: Potential Webshell Access on Citrix NetScaler Appliance
id: 3f9c1a72-6b84-4e21-b5d9-8c2a7f4e1d06
status: experimental
description: Detects HTTP requests consistent with webshell access in the NetScaler GUI tree following exploitation of a pre-auth RCE. Legitimate GUI .php endpoints follow known naming conventions; requests to atypical .php paths or with shell-like parameters are high-fidelity indicators.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/07
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/netscaler/ns_gui/'
      - '/vpn/'
      - '/logon/'
  selection_ext:
    cs-uri|endswith: '.php'
  selection_suspicious:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'shell='
      - '/bin/sh'
      - '/bin/bash'
      - 'base64'
      - 'curl%20'
      - 'wget%20'
  condition: selection_uri and selection_ext and selection_suspicious
falsepositives:
  - Legitimate administrative API automation against NetScaler NITRO endpoints
level: high
---
title: NetScaler Web Process Spawning Shell or Download Utility
id: 8b2e5d41-1c93-4a76-9f3c-5e6b0d8a2f47
status: experimental
description: Detects the NetScaler web server or packet engine processes spawning interactive shells, download utilities, or script interpreters on the underlying FreeBSD OS - a hallmark of post-exploitation activity following remote code execution.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/07
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/nsppe'
      - '/nsaggregatord'
      - '/php'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/csh'
      - '/tcsh'
      - '/perl'
      - '/python'
      - '/curl'
      - '/fetch'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor support scripts executed during Citrix support engagements
  - Legitimate monitoring agents (verify parent process and command line)
level: critical

Microsoft Sentinel KQL

If you forward NetScaler logs to Sentinel via CEF/Syslog (you should — off-box logging is the only reliable forensic record on these appliances), hunt for webshell-style requests and anomalous egress from the appliance:

KQL — Microsoft Sentinel / Defender

// Hunt 1: Webshell-style requests against NetScaler paths (CEF syslog from WAF/NS)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("/netscaler/ns_gui/", "/vpn/", "/logon/")
| where RequestURL has_any (".php", "cmd=", "exec=", "shell=", "/bin/sh", "base64", "curl", "wget")
| extend UriPath = tostring(split(RequestURL, "?")[0])
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by UriPath, DestinationHostName, DeviceAction
| where RequestCount < 50  // webshells are low-and-slow; legitimate GUI endpoints are high volume
| order by FirstSeen asc;

// Hunt 2: Anomalous egress connections FROM NetScaler appliances (Syslog/CEF flow data)
let NetScalerHosts = dynamic(["ns-ip-1", "ns-ip-2"]);  // populate with your NSIP/SNIP addresses
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where SourceIP in (NetScalerHosts) or DeviceHostName has "netscaler"
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, Protocol
| where ConnectionCount < 20  // novel, low-volume egress = potential C2
| order by FirstSeen desc;

Velociraptor VQL

Velociraptor cannot run on the NetScaler appliance itself, but if exploitation led to pivoting onto Windows infrastructure (jump hosts, StoreFront servers, AD), hunt for post-compromise execution artifacts and webshell staging on DMZ-adjacent servers:

VQL — Velociraptor

-- Hunt for recently created script/webshell files and suspicious
-- processes on DMZ and gateway-adjacent Windows servers
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(netscaler|nsconf|citrix).*?(curl|wget|invoke-webrequest|certutil|bitsadmin)'
   OR CommandLine =~ '(?i)(/bin/sh|base64 -d|frombase64string)'
   OR (Name =~ '(?i)(w3wp|httpd)' AND CommandLine =~ '(?i)(cmd|powershell|pwsh)')

VQL — Velociraptor

-- Hunt for recently modified web content files (webshell staging)
-- Run against StoreFront / IIS / DMZ web servers
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/inetpub/**/*.aspx', accessor='ntfs')
WHERE Mtime > now() - (14 * 24 * 3600)
ORDER BY Mtime DESC

Appliance Verification and Hardening Script

Run these checks on each NetScaler via SSH before and after patching. Any unexpected file, cron entry, or listener warrants a full IR engagement.