A critical pre‑authentication command‑injection flaw in Citrix NetScaler ADC and Gateway has been used by threat actors to drop web shells, create superuser accounts, and conceal their presence behind CSS‑style URLs. The vulnerability was uncovered by LevelBlue’s Threat Hunt Operations & Research (THOR) team, who documented the attackers’ tactics and the potential damage to affected organizations.
The flaw allows an unauthenticated attacker to inject arbitrary commands into the NetScaler web interface. Once the commands execute, the attacker can write a web shell to the device’s file system, elevate privileges to a superuser, and then map the shell to URLs that mimic CSS files. This obfuscation makes the malicious code harder to detect by conventional web‑application firewalls and security scanners.
The command‑injection vulnerability is triggered by manipulating the „Host” header in HTTP requests. By inserting shell commands into this header, attackers can bypass authentication and execute code on the NetScaler appliance. The payload creates a new user with administrative privileges, then writes a web shell to a directory that serves static content. Finally, the shell is linked to URLs ending in „.css” or similar extensions, exploiting the fact that many security tools treat CSS files as harmless.
LevelBlue’s analysis shows that the attackers use the shell to gather configuration data, including credentials, certificates, and network topology. This information can be leveraged for lateral movement or to compromise other systems in the same network. The attackers also employ the CSS‑style URLs to evade detection by intrusion‑detection systems that flag typical web‑shell patterns.
Citrix NetScaler appliances are widely deployed in enterprise environments to load‑balance traffic and secure web access. A single compromised device can expose thousands of users to credential theft and data exfiltration. The ability to create a superuser account means attackers can maintain persistent access even if the initial vulnerability is patched. Moreover, the use of CSS‑like URLs to hide the shell reduces the likelihood of discovery by security teams.
Many organizations have already issued patches for the affected NetScaler versions. However, the patching process can be complex, and some older or legacy deployments remain unpatched. The threat actors appear to target high‑value networks, including those in finance, healthcare, and government sectors.
Organizations should first verify whether their NetScaler appliances are running the latest firmware. If a device is still vulnerable, it must be upgraded immediately. In addition, administrators should enforce strict access controls, monitor for unusual user creation events, and inspect web traffic for suspicious CSS requests. Deploying a web‑application firewall that flags non‑standard URL patterns can provide an extra layer of defense.
Security teams should also review NetScaler logs for evidence of command‑injection attempts. Any unauthorized „Host” header manipulations or new user accounts should trigger an investigation. Finally, consider segmenting critical infrastructure to limit the impact of a single compromised appliance.
Q: Which NetScaler versions are affected? A: The vulnerability exists in NetScaler ADC and Gateway firmware versions prior to the patch released in September 2026. Check the Citrix security advisory for exact version details.