NetScaler ADC and Gateway Hardening Guide: Management Lockdown, Gateway MFA and Session Revocation

NetScaler ADC and NetScaler Gateway (formerly Citrix ADC and Citrix Gateway) hold the session tokens for every remote user who signs in through them, and memory disclosure flaws have repeatedly let attackers read those tokens and walk past MFA. CitrixBleed (CVE-2023-4966) in 2023 and CitrixBleed 2 (CVE-2025-5777) in 2025 both leaked live session material, and in both cases patching alone did not evict attackers who already held stolen tokens. NetScaler appears in the CISA Known Exploited Vulnerabilities catalogue more than twenty times. This guide covers administrator and machine identity on NetScaler, the vendor's Secure Deployment Guide settings, Gateway authentication, session revocation after a vulnerability, and the logs that reveal session hijacking. It is for ADC and remote access engineers and the SOC teams who monitor them. For the cross-vendor view, see the VPN Security Guide.

Key takeaways

• Patch, then kill every session. After CitrixBleed, NetScaler told customers to upgrade and then run kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all and clear lb persistentSessions; skipping this left stolen tokens valid.
• Keep the NSIP off the internet. The Secure Deployment Guide places the NSIP, the SDX Management Service IP and LOM in a management VLAN behind a stateful firewall, separate from the outside and server networks.
• Retire nsroot from daily use. nsroot cannot be deleted, so change its password, create an alternative superuser, move administrators to external authentication and set localAuth DISABLED once external authentication works.
• Put MFA in front of every Gateway virtual server. NetScaler's Gateway recommendations place the MFA factor before the LDAP factor, enable login encryption and set authorisation to default deny.
• Watch for one session used from two places. SSLVPN TCPCONNSTAT records where the client IP and source IP differ, or one source IP touches many users, are the signal NetScaler itself pointed to for session hijacking.

How identity and access work in NetScaler ADC and Gateway

A NetScaler appliance (MPX hardware, VPX virtual, SDX multi-tenant, or CPX container) has several IP address roles, and access depends on which one is used.

• Administrators: system users, local or external (RADIUS, TACACS+, LDAP or LDAPS), bound to command policies. NetScaler documents built-in command policies superuser, operator, network and read-only, and custom command policies can be written.
• Gateway and AAA users: authenticate through nFactor flows (LDAP, RADIUS, SAML, OAuth, certificates, OTP). After authentication NetScaler issues a session cookie, and that cookie is the credential attackers steal.
• Machine identities: the RPC node password used between HA and cluster peers, the internal user account, LDAP bind accounts, RADIUS shared secrets, SAML signing keys, TLS private keys for every virtual server, the key encryption key (KEK) that protects stored secrets, and credentials that NetScaler Console or automation tools hold for the NITRO API.

Admin roles and privileged access

1. Change default credentials: change the nsroot password (and the SDX and LOM defaults), and enable set system parameter -forcePasswordChange ENABLED so new appliances demand it at first login.
2. Create an alternative superuser: add system user <name> and bind system user <name> superuser 0. Vault the nsroot and alternative superuser credentials and use them only for break-glass. See the Break-Glass Account Guide.
3. External authentication with MFA: configure RADIUS, TACACS+ or LDAPS for administrators, test it, then disable local management logon with set system parameter localAuth DISABLED. The vendor notes this requires an external server to be configured first, so keep a console path for recovery.
4. Least privilege command policies: bind read-only or network policies to most users, keep superuser to a few, and on SDX bind a shell deny command policy to VPX instance administrators and clear Shell/SFTP/SCP Access when creating instances.
5. Password and lockout policy: -strongpassword ENABLED and -minpasswordlen, set aaa parameter -persistentLoginAttempts DISABLED, and lock aaa user for suspicious accounts.
6. Timeouts: the default timeout is 900 seconds, set per user, group or globally; -restrictedtimeout ENABLED confines it to between 5 minutes and 1 day.
7. SSH: use your own 2048-bit or larger key pairs rather than defaults, prefer key authentication for administrators of many appliances, and set AllowTcpForwarding no in a persistent sshd configuration copied to /nsconfig.

Management plane settings

Integrations, API tokens and service accounts

• NITRO API and NetScaler Console: automation, Terraform and NetScaler Console call the NITRO REST API on the NSIP with system user credentials. Give each integration its own system user with a narrow command policy, store its password in a secrets manager, and remember that NetScaler Console holds credentials for every managed instance, so it needs the same protection as the appliances. See the API Key Management Guide.
• LDAP bind accounts: use LDAPS and TLS 1.2 or 1.3 to directory and Web Interface servers (the Gateway recommendations reject TLS 1.1, 1.0 and SSLv3), with a dedicated read-only bind account.
• RADIUS and OTP: treat RADIUS shared secrets as privileged credentials with an owner and rotation. See the RADIUS Security Guide.
• SAML: when NetScaler is a SAML service provider, set Reject Unsigned Assertions to STRICT so both the response and the assertion must be signed; ON is the minimum. See the SAML Security Guide.
• TLS private keys: every virtual server key on the appliance should be considered exposed after a confirmed compromise. Inventory them, consider a FIPS appliance for stronger key protection where required, and plan re-issue.
• HA and cluster secrets: RPC node passwords and cluster heartbeat settings (secureHeartbeats ENABLED on 14.1 build 12 and later) keep peers from being spoofed.

Gateway authentication and session settings

The Change Healthcare breach of 2024 started at a Citrix remote access portal that, in UnitedHealth's own words to Congress, did not have multifactor authentication. One stolen password was enough. See the Phishing-Resistant MFA Guide.

Logging and detection

Send NetScaler syslog (including the SSLVPN and AAA events) to a central collector, and keep NetScaler Console or SIEM alerting on administrative changes.

For forensics on an unpatched instance, NetScaler suggested collecting NSPPE process memory snapshots, which need at least 5 GB of free space, and deleting the core files from /var/core afterwards. See the Edge Device Compromise Investigation Playbook and the VPN and Firewall Log Detection Guide.

Metrics

• Patch and revoke time: hours from a Critical NetScaler bulletin to fixed build plus full session termination on every appliance.
• Exposed management: NSIPs, SDX Management Service and LOM addresses reachable from the internet (target: zero).
• MFA coverage: percentage of Gateway and AAA virtual servers whose nFactor flow enforces MFA.
• Local admin logons: count of nsroot or local superuser logons per month (each should map to a break-glass record).
• Session anomaly rate: TCPCONNSTAT IP mismatches per day, and time to triage each.

Hardening baseline

1. Inventory and patch: list every MPX, VPX, SDX and CPX instance with its build and which Gateway, AAA and load balancing virtual servers it hosts. Upgrade to the fixed builds in each security bulletin (for CitrixBleed 2, 14.1-43.56, 13.1-58.32 or the matching FIPS builds). In HA pairs, upgrade the secondary, fail over, then the other node.
2. Revoke sessions immediately after each upgrade: run the full kill and clear command set on each appliance in the pair or cluster, then force users to re-authenticate. Plan the user impact in advance so it is not skipped.
3. Hunt before declaring clean: review TCPCONNSTAT mismatches, new system users and changed files for the exposure window. If compromise is suspected, rebuild from a clean image, then rotate the KEK, nsroot and every administrator, RPC node, LDAP, RADIUS and NITRO credential and re-issue TLS keys.
4. Isolate management: move NSIP, LOM and SDX management into a management VLAN behind a stateful firewall, set -gui SECUREONLY and -restrictAccess enabled, and check that no SNIP offers management. Test from a user network that management is unreachable; roll back by restoring the saved ns.conf.
5. Rebuild administrator access: alternative superuser, external authentication with MFA, command policies, then localAuth DISABLED. Pilot on a non-production pair first.
6. Harden the Gateway: MFA before LDAP in nFactor, login encryption, default deny authorisation, host header and IP reputation responder policies, reCAPTCHA, TLS 1.2 or 1.3 to back ends.
7. Protect peers and secrets: secure RPC with certificate validation, secure heartbeats, KEK rotation, encrypted persistence cookies.

Framework mapping

ISO/IEC 27001:2022 Annex A equivalents are A.8.2, A.8.5, A.8.8, A.8.9, A.8.15, A.8.16 and A.8.20.

Common misconfigurations

• Patching without killing sessions: in the CitrixBleed 2023 attacks, Comcast's Xfinity saw unauthorised access after it had patched, because session cookies stolen earlier still worked. Patching closes the leak; only session termination evicts token holders. See the Session Hijacking and Cookie Theft Guide.
• Killing only some session types: for CitrixBleed 2, Citrix's advice named ICA and PCoIP sessions, and researchers criticised it for not clearly covering every session type. Run the full command set, including AAA sessions and persistent load balancing sessions.
• nsroot as the everyday account: shared across the team, never rotated and unrecoverable from the audit trail.
• Management on a SNIP or VIP reachable from the internet: turns any management interface flaw into an internet-facing one.
• LDAP as the only factor on the Gateway: password spraying and stolen credentials go straight through, the Change Healthcare pattern.
• Rebuilding without rotating secrets: an appliance image can be clean while the KEK, RPC node password, bind accounts and TLS keys copied by the attacker remain valid.

Practitioner checklist

• Run fixed builds for every KEV-listed NetScaler vulnerability on every MPX, VPX, SDX and CPX instance.
• After each upgrade, run kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all and clear lb persistentSessions on every node.
• Place NSIP, LOM and SDX management in a management VLAN behind a stateful firewall; set -gui SECUREONLY and -restrictAccess enabled.
• Change nsroot and other default passwords, create an alternative superuser and vault both.
• Move administrators to external authentication with MFA, apply command policies, then set localAuth DISABLED.
• Enforce MFA before LDAP in every Gateway and AAA nFactor flow, with login encryption and default deny authorisation.
• Give each NITRO API integration its own least-privilege system user and protect NetScaler Console as a privileged system.
• Enable secure RPC with certificate validation, rotate the RPC node password and the KEK.
• Alert on TCPCONNSTAT client and source IP mismatches, new system users and unexpected files.
• After any confirmed compromise, rebuild and rotate every credential and TLS key the appliance held.

Standards and references

• NetScaler: Secure Deployment Guide, Network Security
• NetScaler: Secure Deployment Guide, System and User Accounts
• NetScaler: Gateway Security Recommendations
• NetScaler: Secure Deployment Guide, Deployment Guidelines
• NetScaler: Investigation Recommendations for CVE-2023-4966
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Web Session Cookie

Related NHI Mgmt Group resources: VPN Security Guide · Token and Session Security Guide · Load Balancer Security Guide · F5 BIG-IP Hardening Guide · Edge Device Security Guide