🔴 Hackers are in corporate VPNs! Two serious Citrix bugs allow passwordless access

Passwords are not required in new attacks on Citrix NetScaler. Citrix has disclosed two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway, which allow attackers to directly attack corporate VPNs and other edge services from the Internet. Both vulnerabilities received a CVSS 4.0 score of 9.5 and were already exploited by attackers before the patches were released.

Just a few weeks earlier, NetScaler had already been attacked via a vulnerability that allowed authentication bypass.