Citrix Archive – Page 2 of 10 – Deyda Consulting Blog

Checklist for NetScaler (Citrix ADC) CVE-2023-3519

Citrix issued an alert yesterday (07/18/2023) about a critical vulnerability (CVE-2023-3519) in all NetScaler (Citrix ADC) & Gateway systems. To date, no working exploits have been published.

Current notice: This article covers a specific older NetScaler vulnerability. For a vendor-independent process covering current CVEs, firmware updates and checks for possible compromise, refer to our NetScaler CVE Checklist.

Important ! There are no patches for NetScaler (Citrix ADC) version 12.1 or older. These systems have reached their EOL and will therefore no longer be equipped with the necessary fix. In this case please update to the latest 13.0 or 13.1 version.

The vulnerability allows anonymous remote code execution and thus unauthenticated attackers to take over various machines with root privileges.

As we hear from the Citrix community, more and more attacked systems are being found. The first exploits have also been available for purchase on the dark web for some time.

Checklist for NetScaler (Citrix ADC) CVE-2023-4966

Citrix issued an alert (10/10/2023) about a critical vulnerability (CVE-2023-4966) in all NetScaler (Citrix ADC) & Gateway systems. Several working exploits have been published.

Please note that simply updating the systems is not enough. The connection tokens must also be reset.

Important ! There are no patches for NetScaler (Citrix ADC) version 12.1 or older. These systems have reached their EOL and will therefore no longer be equipped with the necessary fix. In this case please update to the latest 13.0, 13.1 or 14.1 version.

The vulnerability allows anonymous remote code execution and thus unauthenticated attackers to take over various machines with root privileges.

Checklist for NetScaler (Citrix ADC) CVE-2025-5777 & CVE-2025-6543

On June 17, 2025, Citrix published a security advisory for CVE-2025-5777, followed by CVE-2025-6543 on June 25, 2025. Both are classified as critical and are actively being exploited in the wild.

Threat Overview

CVE-2025-5777: Critical vulnerability due to improper input validation → leads to memory overread
CVE-2025-6543: Enables memory overflow, potentially resulting in DoS or arbitrary code execution → Exploits available !

⚠️ Important: Simply applying the firmware update is not enough. You must manually terminate all active ICA and PCoIP sessions after patching to ensure the vulnerability is fully mitigated.

Citrix License Activation Service (LAS): Goodbye License Files

If you’re a Citrix customer and thinking “next week…” right now — understandable. But starting April 15, 2026, file-based Citrix license files will no longer work. This is not a warning; it’s a hard shutdown date.

That means: if you haven’t migrated to LAS by then, you risk real outages (apps, desktops, or features depending on the component and version).

LAS is not a migration of your workloads to the cloud. Your site continues to run on-premises (DDCs, StoreFront, VDAs, etc.).
The only thing that changes is the activation and licensing mechanism.

Workaround after Remote Assistance Error

After installing the January 2026 Microsoft security updates, Remote Assistance (msra.exe) no longer works on multiple Windows versions. This directly affects Citrix Director Shadowing, as the generated invite files can no longer be opened on patched systems.

The issue is caused by a security hardening related to CVE-2026-20824 – Windows Remote Assistance Security Feature Bypass Vulnerability. While the fix is technically correct from a security perspective, it currently breaks legitimate Remote Assistance workflows in enterprise environments.