Two unpatched Citrix NetScaler zero-days under active exploitation: what to do today if your Mexico operation logs in through Citrix

On September 27, The Hacker News reported that two remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway are being exploited in the wild, and Citrix has not shipped a patch yet. Remote code execution means someone on the internet, with no username or password, can run commands inside the box.

If your team in Mexico reaches the VPN or its applications through a Citrix portal, this is your problem today, even when headquarters manages the device. Here is what NetScaler is, how to tell whether your Mexico site depends on it, and what to do before the patch exists.

What NetScaler is and why it sits at the front door

NetScaler is an appliance, physical or virtual, that sits at the edge of the network between the internet and your servers. It usually does three jobs: it is the VPN gateway, it publishes applications such as the ERP or virtual desktops so people can work from anywhere, and it spreads traffic across several servers (that is the load balancer part).

Because it faces the internet all day, it is the first thing an attacker tries. In our experience it is also one of the least reviewed boxes in a Mexican subsidiary, because “corporate set it up years ago and it just works”.

How to tell if your Mexico operation uses it

Ask the accountant in Monterrey how they log in from home. If they open a page with a Citrix logo, use the Citrix Workspace app, or the login screen says “NetScaler Gateway” or “Citrix Gateway”, you use it.

Other clues: the address they type is something like access.yourcompany.com and the VPN lives there too, or headquarters “publishes” the applications to the Mexico site. If nobody at the plant knows who administers it, that is the first call of the day, to HQ or to the provider.

What to do today, while there is no patch

A zero-day is a flaw attackers are already using before the vendor has a fix. You cannot patch, but you can get in their way.

Measure	Why it helps
Take the management interface off the internet	It is the most dangerous door and almost never needs to be public
Restrict by IP whatever must stay reachable	An attacker from any country loses the ability to touch it
Review active sessions and recently created accounts	Whoever got in usually leaves a “spare” user behind
Hunt for web shells and odd files on the box	A web shell is a hidden file that lets them come back whenever they want
Watch the logs daily	Logins at odd hours or from countries where you have no staff are the signal

If a published app has not been used in months, switch it off. Old portals nobody remembers are a very common find.

Have the patch plan ready before the patch exists

It sounds odd, but it saves the most time. When Citrix ships the fix, you do not want to start looking for who holds the admin password in Mexico.

Get ready today: a backup of the configuration, a maintenance window agreed with the Mexico plant (night or weekend, in local time), who tells users, and how you roll back. If you run two NetScalers in high availability (one standing in for the other), patch one, test, then the other. People keep working.

When the box is in Mexico and the team is not

Many subsidiaries live exactly this scenario: the alert goes out from HQ at 3 a.m. Mexico time, the appliance is in a rack in Querétaro and nobody at the plant knows where the console cable is.

That is where local hands change everything: someone who walks into the server room, confirms model and version, applies what HQ instructs and reports back with evidence. It is what we describe in how to get IT smart hands in Mexico.

Let’s talk

And in your Mexico operation?

If anyone reaches your VPN or applications through Citrix, the perimeter review is for today, not next week. At ProcessBi we run that urgent review, apply the mitigations without stopping the plant and, as soon as Citrix publishes, patch inside a maintenance window. For headquarters abroad, we are the hands in Mexico, in English or Spanish.

Request your free review — we reply the same business day.