Citrix NetScaler: Critical Security Vulnerability Exploited

Cybercriminals are currently exploiting a critical Pre-Authentication Command Injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This security flaw allows attackers to install web shells and steal configuration data. The Threat Hunt Operations & Research (THOR) group from LevelBlue has analyzed and documented these activities in several customer environments. The vulnerability, classified as CVE-2026-1234, affects systems that are not adequately secured against unauthorized commands. Attackers can access the systems through this vulnerability without prior authentication.

The threat has been observed across various industries, indicating widespread exploitation. Analyses show that attackers are capable of implementing web shells that enable them to take control of the affected systems. These web shells are often configured to be accessible via URLs that exhibit CSS-like structures, making detection by security solutions more difficult. The THOR group has identified specific patterns indicative of this type of attack. In addition to installing web shells, attackers are attempting to steal sensitive configuration data.

This data may contain critical information about the infrastructure and security configurations of the affected companies. The THOR group has found that attackers are specifically searching for information that would allow them further access to the systems. The vulnerability has already been confirmed by Citrix, and the company has announced an update to address the flaw. The release of the patch is expected in the coming weeks. Companies using Citrix NetScaler are strongly advised to review their systems immediately and take the necessary security measures.

The threat landscape is exacerbated by the fact that many companies may not have the latest security updates. A survey by the BSI revealed that 35% of companies in Germany do not regularly update their systems. This could enable attackers to continue exploiting the vulnerability. Experts recommend that companies review their security policies and ensure that all systems are up to date. Implementing Intrusion Detection Systems (IDS) can also help detect suspicious activities early.

The THOR group has already released several Indicators of Compromise (IoCs) that companies can use to identify attacks. The situation highlights the ongoing threat of cyberattacks on critical infrastructures. Security researchers warn that such attacks may increase in the future, especially if companies do not take proactive measures. The THOR group has emphasized that a swift response to security incidents is crucial to minimize damage. According to Citrix, the CVE-2026-1234 vulnerability affects several versions of NetScaler ADC and NetScaler Gateway. Companies should check the specific versions to ensure they are not affected.