Threat video1:00
CTX697305 NetScaler Fixes 28 Flaws: Detection & IOCs
CVE-2026-120868 is a pre-auth memory overflow in default NetScaler configs with no workaround. Check 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Citrix NetScaler CTX697305 patch →
Chapters
- 0:00The hookCitrix patched 28 NetScaler flaws.
- 0:04The storyOne critical flaw affects default setups.
- 0:11Attack pathPrioritize internet-facing appliances.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise1 indicator to hunt: 1 path.
- 0:37MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation3 steps now: Upgrade NetScaler ADC/Gateway.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Citrix patched 28 NetScaler flaws.
0:05One critical flaw affects default setups.
0:08No workaround. Upgrade required.
0:12Prioritize internet-facing appliances.
0:14Gateway setups carry the top score.
0:17Search running configs for SAML entries.
0:20A medium flaw logs login data readable locally.
0:27No threat actor is attributed. Confidence: low.
0:321 indicator to hunt: 1 path.
0:385 ATT&CK techniques, from reconnaissance to impact.
0:433 steps now: Upgrade NetScaler ADC/Gateway.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.