I've been having customers start to ask the question.... "With all these latest CVEs, and active exploits, leadership wants us to start looking at alternatives."

Just send them the list of CVEs affecting the 'other' ADCs

my thoughts exactly

Find me an alternative that doesn't have CVEs and i'll find you some oceanfront property in Iowa

Exactly

well it seems we agree.. haha

we do all agree, but the conversations are being had.

it's a valid question.. to give leadership a bit of credit

Yep gotta put on the sales hat

both F5 and CheckPoint had actively-exloited, KEV-listed vulnerabilities disclosed at the same time as these last netscaler CVEs.

my.f5.com/manage/s/article/K000162605 F5 had a major vulnerability a couple weeks back

I think what really matters that who's in the drivers seat, regardless of the logo in the GUI. If you're sec baseline is kept up to date, your operative stuff is in order, etc... that's definitely something to put value in.

It's also common to have more vulnerabilities found shortly after the initial one

there are a few things that do come to mind however, that could reduce what's internet facing, such as moving to Citrix Gateway service. But I struggle with this, because it puts the downtime risk on Citrix (which has not had great uptime) instead of localized to the customer environment. Is anyone here doing this, and have a valid reason why it's.... better?

Gateway Service is nice for that if Gateway is all you do on the NetScaler (Kind of using a Semi to haul a kayak). Problem with service becomes if people can't login, you get to talk with the ChatBot and hopefully get a ticket open and a support rep who knows something. Otherwise, you are waiting for Citrix Support to fix the problem. Most people don't realize F5 had a 9.8 vulnerability the Wednesday before the NetScaler 9.5s were released. May not have affected as much but as others have said, you can't find another vendor who also doesn't have vulnerabilities. We all accept that Microsoft has so many that we plan on "Patch Tuesday" but no one is saying move to MacOS or Linux.

obviously all of us agree... but need to have validation, and responses queued up for customers who are starting to ask these questions.

Have there been any CVE's for Omnissa's UAG as bad as this?

haha kevin Beaumont loves slagging off Citrix and Netscalers i am intrigued to see what he moved his environments to as well

@jeremy.holt we are planning to migrate to CGS, for me it's a matter of risk of an unpatched, undisclosed zero day vs the risk of availability for external users. 2026, and the future with AI enabled offensive baddies, have tilted the risk much more heavily to the former than the latter. We aren't using the NetScalers for much beyond ICA proxy at this point so that removes much of the complexity in doing so.

While no technology is perfect, internet-facing products that grant access to internal corporate networks are prime targets for attackers. Previously, vulnerability discovery was relatively low, but advanced AI now excels at rapidly exposing these flaws... 🤷‍♂️

good point about AI and how it's exposing things rapidly... The part that is also great is that both sides have access to Advanced AI.... my thought is get really good at using this "new" tool (AI) b/c the bad guys are certainly going to take any advantage they can get.

• @Jason Symczak SSRF in Secure Email Gateway (SEG) when hosted on UAG (CVE-2025-25235, CVSS 8.6 High) — SEG prior to 2503 running on UAG could be used to route network requests to internal resources. • CORS bypass in UAG — a malicious actor with network access could bypass admin-configured CORS restrictions to reach sensitive data. Lower severity, no RCE path. • Generic Linux kernel exposure — UAG is a hardened Linux appliance, so it inherited exposure to CVE-2026-31431 ("Copy Fail," a kernel LPE affecting nearly all distros). Omnissa assessed UAG as not practically exploitable there since the appliance has no low-privileged users to abuse it, with a fix pending. • Most of the higher-severity "Omnissa" CVEs you'll see in feeds (CVE-2025-25231, CVE-2025-25236, path-traversal/enumeration issues) are actually Workspace ONE UEM — the MDM product — not UAG itself. • The honest comparison: no UAG-specific unauthenticated RCE, no KEV listing, no CVSS 9+ actively-exploited bulletin — nothing resembling CVE-2026-88771/88772 (NetScaler), CVE-2026-94127 (F5 BIG-IP APM), or the Check Point VPN pair from September. UAG's disclosed issues to date skew toward SSRF/CORS/info-disclosure rather than appliance takeover. That's a legitimately different risk profile, not just better luck — but it's also a smaller, less-scrutinized install base than NetScaler, so it's drawn less researcher attention

@Neal Dolson I agree the balance of risk vs remote downtime is tilting for us as well

That is why the Webroot IP Reputation monitoring is becoming much more important. The IP addresses doing the exploits and the SAML DoS were all in the database and would have been dropped with a "is_malicious" policy.

@Devin McCubbins AI tools do work both ways, but IMO admins are probably stretched thin, wearing multiple hats, may not even have a dedicated security/research team that can focus on those sort of things...whereas the red teamers are singularly focused with deep knowledge on the targets. I'd guess it'll be harder for blue team to keep up, even with AI-enabled tools available.

it still aint fair.. i agree

They also can be wrong and unsuccessful 5000 times and only need to be successful once where you can be successful 5000 times at blocking them and only miss once.

precisely why red team always has advantage..

Just gather a list of alternatives, and all their CVEs as well