Citrix Zero-Days Are Being Exploited Right Now: What Your Backups Need to Handle

Citrix has confirmed two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway that are being actively exploited in the wild right now. According to BleepingComputer, both flaws allow remote code execution, meaning an attacker who finds your NetScaler appliance on the internet can run their own commands on it without needing a password. CISA followed up by ordering all U.S. federal agencies to patch by Wednesday. Canada has no equivalent mandatory order for private businesses, which means Canadian SMBs are on their own here.

If your business uses Citrix to let staff connect remotely, or uses NetScaler to manage web traffic and application delivery, this affects you directly. These are not theoretical vulnerabilities. Citrix confirmed exploitation is already happening.

What Attackers Can Do With Remote Code Execution

Remote code execution is the worst-case vulnerability category. It means an attacker does not need to trick an employee into clicking a link or handing over a password. They find the device, send a specially crafted request, and they are in. From there, the playbook is well established: move laterally through your network, escalate privileges, find your file servers, encrypt everything, and demand a ransom.

In attacks like this, the gap between initial access and full network compromise is often measured in hours, not days. By the time anyone notices something is wrong, the damage is already done.

That is exactly why your backup and recovery posture matters as much as your perimeter defenses. If your files are encrypted and your backups are also gone or corrupted, you have no good options left.

The Backup Problem Most SMBs Don't Know They Have

We talk to business owners every week who believe they have a backup. When we look more closely, we find one of three problems.

First, the backup is connected to the same network it is protecting. Ransomware groups specifically hunt for backup systems and encrypt them first. A backup drive plugged into your server, or a backup agent running on the same domain, is not a real backup in a ransomware scenario.

Second, the backup runs nightly but nobody has ever tested a restore. We have seen cases where backups were silently failing for weeks. The business owner thought they had 30 days of recovery points. They had zero.

Third, the backup covers files but not system state. Recovering a database or a line-of-business application is not the same as restoring a folder of documents. If your accountant's software, your CRM, or your inventory system is not included in the backup scope, you may recover the data but still spend days rebuilding the environment it runs in.

What a Proper Backup Setup Looks Like in 2026

The standard we follow for our managed clients is a 3-2-1-1 model. Three copies of data, on two different media types, with one copy offsite, and one copy air-gapped or immutable. Here is what that looks like in practice for a typical Canadian SMB.

• Local backup with immutable snapshots. Tools like Veeam Backup and Replication or Acronis Cyber Protect can write backups to a local repository that is locked against modification for a set number of days. Even if ransomware hits your domain, it cannot touch those snapshots.
• Cloud replication to a Canadian data centre. We replicate to Canadian-region object storage, either Wasabi's Montreal region or Amazon S3 in ca-central-1, to keep data under Canadian jurisdiction. Replication happens multiple times per day, not just overnight.
• Tested restore procedures. We schedule quarterly restore tests for every client. We pull a random file, a random virtual machine, and a random application database, and we time the recovery. If it fails, we fix it before there is an emergency.
• Separation from your main domain. Backup credentials are stored separately and not connected to your Active Directory. An attacker who compromises your domain admin account should not automatically have the keys to your backups.

What to Do Right Now If You Use Citrix NetScaler

If you have a NetScaler ADC or NetScaler Gateway appliance, the immediate step Citrix recommends is to take it offline if you cannot patch it immediately. BleepingComputer reported that Citrix has specifically advised administrators to shut down unpatched NetScalers given the active exploitation. That is an unusual recommendation and signals how serious the situation is.

Patching alone is not sufficient if exploitation has already occurred. You need to treat a potentially compromised appliance as a compromised appliance. That means reviewing logs, looking for unusual outbound connections, checking for new accounts or scheduled tasks, and confirming your backups are intact and untouched.

If you are not sure how to do any of that, call us. We can run a compromise assessment and get your backup posture confirmed before this turns into a recovery situation.

The Bigger Picture

Vulnerabilities like these Citrix zero-days appear several times a year. The pattern is always the same: a flaw is disclosed, exploitation starts immediately, patching takes time, and businesses that had working offline backups survived while businesses that did not were forced to pay ransoms or rebuild from scratch.

Your backup is not an IT checkbox. It is the difference between a bad week and a business-ending event. If you are not certain your current backup would get you through a full ransomware wipe today, that is worth one conversation with our team to find out.