On September 27, 2026, Citrix published a security bulletin covering eight new vulnerabilities in NetScaler ADC and NetScaler Gateway. Some of these vulnerabilities are critical and have already been exploited in the wild.
Citrix released fixed NetScaler builds and recommends upgrading affected appliances as soon as possible. However, when a vulnerability is already being actively exploited, installing the update only solves part of the problem.
There is another important question to answer: was the NetScaler already compromised before it was upgraded?
This is where a relatively new feature in NetScaler Console becomes particularly useful: Indicators of Compromise detection.
Indicators of Compromise detection
Indicators of Compromise, or IoCs, are traces that can indicate that a system has been compromised. These can be files, configuration changes, processes or other artifacts left behind after successful exploitation of a CVE.
Citrix has provided IoC information and detection scripts for NetScaler security vulnerabilities before. These scripts typically had to be obtained from Citrix and executed manually from an SSH or CLI session on the NetScaler appliance.
In May 2026, Citrix introduced Indicators of Compromise detection directly in NetScaler Console. Instead of having to obtain and execute these scripts manually on individual appliances, administrators can now initiate the IoC scan centrally from the Security Advisory page in NetScaler Console.
This makes compromise assessment much more accessible, especially when multiple NetScaler appliances need to be checked following a security vulnerability.
The Indicators of Compromise detection page in NetScaler Console.
From vulnerability detection to compromise detection
When a CVE is published, the first step is to determine whether your NetScaler is affected and apply the required remediation. NetScaler Console can help with this through its CVE Detection functionality.
IoC detection answers a different question. It looks for evidence that the vulnerability may already have been successfully exploited.
This distinction is important regardless of the specific CVE. After upgrading a vulnerable NetScaler, CVE Detection may correctly report that the appliance is no longer vulnerable. That does not tell you whether the appliance was compromised before the update was installed.
The vulnerabilities published by Citrix on September 27 are a recent example of why this matters. Some of these vulnerabilities have already been exploited in the wild, making it important not only to upgrade affected appliances but also to check for available Indicators of Compromise.
We will not go into the details of each September 27 vulnerability in this article. Citrix provides the affected versions, conditions and required remediation in security bulletin CTX697096.
Running an IoC scan from NetScaler Console
IoC detection is available from the Security Advisory section of NetScaler Console. When IoC detection logic is available, a scan can be executed against the applicable NetScaler instances directly from the Console. After the scan completes, NetScaler Console reports whether a potential compromise was detected.
Example scan results showing potentially compromised appliances and the indicators detected.
Example results showing No Compromise Detected for the scanned appliances.
The scan result can, for example, show Potentially Compromised or No Compromise Detected. NetScaler Console also keeps the results of previous scans, making it possible to review the scan history for an appliance.
The IoC detection logic can also be updated as new Indicators of Compromise become known. Citrix can publish an updated IoC detection script, and administrators are notified by email when an update is available.
Email notification that updated IoC detection logic is available.
New indicators may become known after the initial investigation of a vulnerability. An earlier scan that reported No Compromise Detected can therefore be followed by another scan using the updated detection logic.
What does "No Compromise Detected" mean?
A clean IoC scan should not be interpreted as a guarantee that an appliance has never been compromised.
Citrix specifically notes that the IoC information does not cover every technique that an attacker could use and that attacker techniques can change over time. As a result, IoC detection may not identify every compromise.
A No Compromise Detected result therefore means that the currently available detection logic did not find the indicators it was looking for.
If there are other reasons to suspect that a NetScaler has been compromised, proper forensic investigation is still required.
Closing Thoughts
IoC detection is a useful addition to the existing security functionality in NetScaler Console.
Security Advisory can identify NetScaler appliances running vulnerable software and help administrators determine the required remediation. IoC detection adds another important piece by helping determine whether there are signs that an appliance may already have been compromised.
For internet-facing NetScaler environments in particular, checking for available IoCs should be part of the security assessment when dealing with vulnerabilities that may have been exploited.
The September 27 security bulletin is a good example. If you have upgraded affected NetScalers, we strongly recommend running the available IoC detection scans as well. When vulnerabilities are known to have been actively exploited, upgrading the appliance should not be the end of the investigation.
