Citrix ADC bug: apply the mitigation tonight
Exploit code for the Citrix ADC and Gateway bug is public, and attacks have started. Patches are still days away.
Citrix announced a critical bug in its ADC and Gateway products (CVE-2019-19781) in December, with a mitigation but no patch. Over the weekend, working exploit code went public. Mass scanning and attacks followed within hours.
These devices usually sit on the internet as the remote-access front door. An attacker who gets in can run commands on them.
- Apply Citrix’s mitigation steps now, and check they actually took effect. Some versions need extra steps.
- Check for compromise: new files in the templates folders, unknown scheduled jobs, unusual processes.
- If compromised, rebuild the device and reset credentials that passed through it.
- Install the permanent fixes as soon as Citrix releases them for your version, expected later this month.
A mitigation published weeks ago is only useful if it was applied. Check, don’t assume.