SharkStriker’s Threat Intelligence researchers are actively monitoring a newly disclosed high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers (IdP).

Citrix NetScaler is widely deployed across enterprise environments to provide application delivery, secure remote access, VPN connectivity, load balancing, and identity federation services. Because these appliances frequently serve as Internet-facing authentication gateways, vulnerabilities affecting them present a significant security risk.

Through this blog, we will understand what the Citrix NetScaler flaw is about and some of the security actions that organizations can take to prevent/respond to the threat.  

About the vulnerability

What can attackers do with the vulnerability?

A remote unauthenticated attacker can send specially crafted requests to a vulnerable NetScaler appliance, triggering a memory overread that may disclose sensitive information stored within appliance memory, including authentication-related data, session information, or other confidential application data. Security researchers have compared this vulnerability to the widely exploited CitrixBleed (CVE-2023-4966) due to its ability to expose sensitive memory contents and its impact on authentication infrastructure.

A remote unauthenticated attacker can send specially crafted requests to a vulnerable NetScaler appliance configured as a SAML Identity Provider. Due to insufficient validation during request processing, the appliance performs a memory overread, exposing portions of process memory that may contain authentication tokens, session information, credentials, or other sensitive application data. The availability of public exploit code significantly lowers the barrier to exploitation, and observed Internet-wide scanning indicates that attackers are actively attempting to identify and compromise exposed systems.

Attackers can exploit the vulnerability to:

• Steal sensitive memory contents
• Leverage exposed authentication tokens
• Hijack sessions
• Gain unauthorized access to enterprise applications
• Steal credentials
• Gain initial access to enterprise applications
• Escalate privileges
• Move laterally across internal networks
• Exfiltrate data
• Further ransomware or APT activity
• Cause a compromise of identity infrastructure

SharkStriker’s recommendations

To reduce the risk associated with this vulnerability, SharkStriker recommends implementing the following defensive measures:

Apply Security Updates

• Immediately Upgrade all affected NetScaler ADC and Gateway appliances to the latest vendor-supported releases containing the security fix.

Identify Vulnerable NetScaler Deployments

Organizations should:

• Identify all NetScaler appliances within the environment.
• Verify whether SAML Identity Provider (IdP) functionality is enabled.
• Prioritize Internet-facing appliances for immediate remediation.
• Validate software versions against Citrix’s fixed releases.

Review Authentication Activity

Investigate:

• Unusual SAML authentication requests.
• Unexpected administrative logins.
• Abnormal VPN authentication activity.
• Suspicious session creation or token usage.
• Authentication anomalies beginning from 30 June 2026 onward.

Restrict External Exposure

Reduce the attack surface by:

• Restricting management interfaces to trusted administrative networks.
• Limiting Internet exposure wherever operationally feasible.
• Applying firewall ACLs to management services.
• Enforcing VPN-only administrative access.

Strengthen Detection Coverage

• Ensure SIEM, EDR, and network monitoring platforms detect:
• Suspicious SAML authentication requests.
• Abnormal NetScaler authentication activity.
• Authentication failures followed by successful logins.
• Unexpected administrative sessions.
• Unauthorized configuration changes.
• Indicators of session hijacking.
• Lateral movement following NetScaler authentication.

Perform Compromise Assessment

• If vulnerable appliances were Internet-facing prior to patching:
• Review historical authentication logs. Examine administrative activity.
• Investigate unusual VPN sessions.
• Validate integrity of appliance configurations.
• Rotate administrative credentials where compromise is suspected.

Maintain Continuous Monitoring

• Until remediation is complete, organizations should maintain heightened monitoring for:
• Suspicious authentication activity.
• Unexpected administrative access.
• Indicators of session hijacking.
• NetScaler-related security alerts.
• Unauthorized access attempts.
• Signs of post-exploitation activity.