Patching isn’t enough: a look behind the scenes at a critical vulnerability

The background: critical vulnerabilities in Citrix NetScaler

At the end of September 2026, Citrix published a security bulletin regarding eight new vulnerabilities in NetScaler ADC and NetScaler Gateway. We know for certain that two of these were already being exploited before they were officially disclosed. The vulnerabilities were therefore classified as high risk and required high-priority attention. This is because NetScaler is widely used as a gateway for remote working, making it a favourite point of entry for attackers. In the weeks that followed, two further security bulletins were issued regarding serious vulnerabilities.

Read the news article on Dutch IT Channel (in Dutch).

First of all: what is patching?

Patching is the installation of an update that fixes a fault in software. Such a fault can be a vulnerability or a security breach. Think of it like a lock on your front door. The manufacturer discovers that the lock can be opened using a trick and supplies a new lock: the patch. After that, the trick no longer works. But had anyone already got in before you replaced the lock? If so, that person is still roaming around your house. That is precisely why patching is only one part of the job. Behind the scenes, the process often unfolds in six phases:

1. The first sign
2. From rumour to threat level
3. The first few hours: assessing and evaluating
4. Evidence first, then the patch
5. After the patch: searching for signs of a breach
6. Cleaning up, reporting and continuing to monitor

Phase 1: the first sign

Security specialists don’t wait until a breach makes the newspapers. They monitor various sources throughout the day. The first sign usually comes from one of these sources: A well-managed team has established these sources as part of a fixed routine, with the aim of knowing as early as possible that something is afoot, so that you don’t only take action once it’s already in the news.

• The security community: think of researchers, CERT teams or colleagues.

• Threat intelligence: specialist organisations track what attackers are doing. For example, they may observe attacks taking place or certain systems being scanned on a massive scale.

• Vendors: including Citrix and Microsoft. They publish security bulletins detailing the nature of the vulnerability, which versions are affected and which update resolves the issue.

• The NCSC: the National Cyber Security Centre publishes security advisories, providing an assessment for each vulnerability of the likelihood of exploitation and the potential damage.

• In-house monitoring: sometimes an organisation itself detects unusual behaviour on a system, even before anything is known about a vulnerability.

Phase 2: from rumour to threat level

A rumour is not yet a fact. How does a vulnerability become official? Who determines how serious it is? Usually, it goes like this: In the case of the Citrix vulnerability, things did not follow this neat path. Two vulnerabilities were already being exploited before a patch was available. The vendor therefore had no time to patch the vulnerability before attackers struck. That is why patching alone was not enough. It was also necessary to check whether systems had already been compromised.

1. Discovery: someone finds the vulnerability. A researcher, your supplier or (unfortunately) an attacker.
2. Confidential reporting: in a standard discovery process, the finder first reports the vulnerability to the supplier. This gives the supplier time to develop a solution before the outside world finds out.
3. A number and a score: the vulnerability is assigned a unique CVE number, so that everyone worldwide is referring to the same vulnerability. This is often accompanied by a CVSS score: a rating from 0 to 10 indicating its severity.
4. Patch and bulletin: the supplier releases an update and publishes a bulletin containing information about the vulnerability and the fix.
5. Assessment by others: the NCSC and threat intelligence organisations assess the likelihood of exploitation and the potential damage.
6. Threat level raised: is the vulnerability being actively exploited, or is that highly likely? If so, they raise the threat level, as happened with Citrix, to ‘high’.

Phase 3: the first few hours – taking stock and assessing

As soon as the vulnerability is confirmed, the clock starts ticking. The IT team’s first question is simple: do we have this system? And if so, where? To answer this, they find out: This is often where it becomes clear whether you have your affairs in order. With an up-to-date overview of your systems, you’ll have this answer almost immediately. Because attackers work at lightning speed, you really don’t have time to spend hours or even days on this.

• which systems the organisation has;
• which version is running on them and whether it’s vulnerable;
• whether the system is accessible from the internet;
• who manages it: your own department or a supplier?

Why VPNs and gateways require extra urgency

NetScaler is a gateway: the portal through which staff log in to their work environment from home or whilst on the move. Such a system is therefore always open to the internet. It is tempting for attackers to breach this system, as there is much to be gained. Once they take control of the gateway, they are immediately inside and can search for systems, accounts and data. Furthermore, the intrusion doesn’t stand out all that much. After all, there’s a lot of traffic passing through a gateway.

Phase 4: evidence first, then the patch

You might think the team would install the update straight away. However, that isn’t the first step. Log files show who logged in when and what happened on a system. An update or restart could erase those traces. If you apply the patch first, you might not be able to tell afterwards whether anyone had already gained access. That is why the team first makes a copy of the logs and other technical data. The update follows afterwards. In practice, there is more to it than simply clicking ‘install’:

Step 1: planning

A gateway is often business-critical. During the update, staff may temporarily be unable to work from home. Someone must decide whether the update should be carried out immediately or only in the evening.

Step 2: testing

Where possible, the update is tested first to ensure nothing else breaks.

Step 3: temporary measures

If the patch cannot be applied straight away, the team implements temporary measures, such as restricting access or temporarily shutting down the system.

Step 4: verification

After the update, the team checks that the new version is actually installed on all systems.

In the event of an active attack, this process takes not weeks, but minutes to hours. This calls for rapid decision-making. And those decisions do not rest solely with IT.

Phase 5: searching for signs of a breach after the patch

The patch is in place. This is the moment when you can breathe a sigh of relief. But for the security team, this is where the most important part of the work begins: are we safe now? Not necessarily. A patch protects you against new attacks via that vulnerability. But a patch does nothing about what has already happened. In the case of a zero-day (when you haven’t had a chance to patch the vulnerability), attackers may have been able to exploit it for days or weeks without you realising. During that time, they may have planted a backdoor, created accounts or stolen login credentials. That backdoor remains active, even after the patch has been applied.

What will the IT team be working on?

The team will look for Indicators of Compromise (IoCs). These are recognisable characteristics that may point to a cyberattack. Examples include characteristics of malware, suspicious IP addresses or domain names. Information on this can be found, amongst other places, in security advisories from the NCSC and other reliable sources.

Among other things, the team checks for: To do this, the team uses the logs that were secured in phase 4. This just goes to show how important they are. They provide insight into what has happened on the systems. Without this data, it is more difficult to trace the evidence of an attack.

• suspicious files on the system, such as a webshell (a programme that allows an attacker to maintain remote access);
• unknown or unexpectedly created accounts;
• suspicious login attempts from unusual locations or at odd times;
• connections to suspicious addresses on the internet.

Phase 6: clean-up, reporting and continued monitoring

What happens in this phase depends on what the team found in Phase 5. If nothing is found, that’s good news. The IT team often keeps a particularly close eye on the systems in the weeks that follow. New IoCs are sometimes only shared later, at which point checks are carried out again. Has something actually been found? Then it becomes an incident. The IT team removes backdoors, resets passwords and sessions, and investigates how far the attacker has got. A technical specialist often assists with this.

Do you need to report an incident?

• Does your organisation fall under the Cyber Security Act (Cbw), which comes into force on 15 August 2026? If so, you have a duty to report serious incidents. Furthermore, responding swiftly and effectively to vulnerabilities is part of your duty of care. Directors bear ultimate responsibility for this.
• Systems containing personal data, such as email, HR systems or customer records, can be accessed via a gateway. If an attacker is able to view this data, a data breach may have occurred. A data breach posing a risk to data subjects must be reported to the Dutch Data Protection Authority within 72 hours.

Our partner Privacy Company can help you determine whether a data breach is reportable and what steps you need to take regarding those affected.

What does this mean for the CISO?

As a CISO, you do not need to apply patches yourself. However, you do need to understand what is happening so that you can ask the right questions and keep the board properly informed. Questions you might ask the IT team include:

• When will we know which systems have been affected?
• Do we retain the logs for long enough to be able to review them?
• Have we already checked whether anyone gained unauthorised access?
• What is the action plan if we find that someone gained unauthorised access?
• Have our staff been informed?
• Since when have we been vulnerable, and do we need to report anything?

As a CISO, it is also wise to ensure that an organisation has overviews and action plans ready. That way, nobody has to improvise when the time comes. Consider:

• an up-to-date overview of all systems
• agreements on patching timelines
• an incident plan specifying who decides what and when reports are made
• a retention period for log files and when the board must be informed

How we help: bridging the gap between technology and management

In many organisations, there is a knowledge gap between those who apply patches and those who make decisions. The technical expert knows what needs to be done, but management does not always recognise the risk. Our CISO's can help with this.

Our CISOs have in-depth knowledge of governance, risk and compliance (GRC). They translate technical risks into clear reports and recommendations. No complicated technical jargon, just plain language explaining where your organisation stands and what choices need to be made. And because information security starts at board level, our CISO works alongside the board and management to make security an integral part of your strategy. Our CISO can support your team for as little as 4 hours a week.

Are you unsure whether everything is in order after the patch?

You’ve applied the patch, but you’re not sure whether anyone has gained unauthorised access. That’s understandable. Let our technical specialists take a look. Together, we’ll go through what’s been done, what’s still missing and what questions you can ask your IT team or supplier.

Do you want to be absolutely sure that your gateway is properly secured? With a penetration test, our ethical hackers will check whether an attacker can still gain access.

We’re always happy to discuss your needs. Feel free to contact us with no obligation.