Citrix urged customers on Tuesday to immediately patch Netscaler ADC and Gateway appliances exposed online against two actively exploited zero-day vulnerabilities.
The two zero-days impact the Netscaler management interface and expose unpatched Netscaler instances to remote code execution and denial-of-service attacks, respectively.
To gain code execution, attackers must be logged in to low-privilege accounts on the targeted instance and need access to NSIP, CLIP, or SNIP with management interface access.
The appliances must be configured as a gateway or an AAA virtual server to be vulnerable to DoS attacks.
The company says that only customer-managed NetScaler appliances are impacted by the zero-days, while Citrix-managed cloud services or Citrix-managed Adaptive Authentication are not affected.
According to data provided by threat monitoring platform Shadowserver, just over 1,500 Netscaler management interfaces are now exposed on the Internet.
In a security advisory published today, Citrix urged all admins to immediately patch their Netscaler appliances against the two zero-days to block potential attacks.
Those still using NetScaler ADC and NetScaler Gateway version 12.1 end-of-life software were also advised to upgrade them to a version still under support.
Admins who cannot immediately deploy today's security updates should block network traffic to affected instances and ensure they're not exposed online.
Another critical Netscaler flaw patched in October and tracked as CVE-2023-4966 was also exploited as a zero-day since August by various threat groups to hack into the networks of government organizations and high-profile tech companies worldwide, such as Boeing.
HHS' security team, the Health Sector Cybersecurity Coordination Center, also issued a sector-wide alert urging health organizations to secure their NetScaler ADC and NetScaler Gateway instances against surging ransomware attacks.
Over 178K SonicWall firewalls vulnerable to DoS, potential RCE attacks.
Critical SonicWall firewall patch not released for all devices.
Microsoft discovers critical RCE flaw in Perforce Helix Core Server.
Juniper warns of critical RCE bug in its firewalls and switches.
Ivanti warns critical EPM bug lets hackers hijack enrolled devices.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 16 Jan 2024 20:35:32 +0000