Citrix and Cisco edge flaws push remote-access gateways to the front of the DACH OT patch queue

The bulletin rates the threat level for OT operators in Germany, Austria and Switzerland as high this week ^[1]. The rating is built from CISA and Cisco advisories and an Industrial Cyber report, and the bulletin does not describe any intrusions at DACH operators ^[23]. Of the flaws it lists, only the two in Citrix NetScaler are described as under active exploitation ^[24].

For NetScaler, the bulletin puts evidence collection before the update. The order it gives:

1. Secure copies of the logs and snapshots first, then search for indicators of compromise, among them the IoCs Citrix makes available in the NetScaler Console ^[9]. 2. Update to the fixed builds listed in the Citrix security bulletin ^[4]. 3. Kill all sessions and rotate the credentials used through the gateway, starting with remote maintenance accounts ^[10]. 4. Hunt for webshells and unexplained gaps in logging, and work out which customer or OT systems the gateway could reach ^[11].

I think that order is right for a box with an exploited pre-auth RCE. A fixed build closes the entry point. It leaves open sessions and captured credentials in place, and steps 3 and 4 go after those ^[10][11]. Step 1 records the state of the box before the update changes it ^[9].

The Cisco flaw needs a different check. CVE-2026-76504 grants admin rights on Catalyst SD-WAN Manager without authentication ^[5]. An admin on the Manager controls the SD-WAN configuration ^[15]. For detection, the bulletin says to search the Manager's access logs for requests with malformed URI encoding, use the full Cisco advisory for the exact IoCs, and start incident response on any hit ^[14]. After that comes a diff of the SD-WAN configuration against a known-good version, looking for routing changes nobody planned ^[15].

Three of the four edge products in the bulletin can be attacked without credentials ^[1]. The fourth is the Lantronix G520 LTE gateway. There, an insecure firmware update chain lets an attacker inject firmware that runs as root ^[17]. An updater that installs whatever it is handed will install the attacker's image as readily as the vendor's ^[17]. The bulletin tells machine builders to check that updates in their own products run only over TLS with a verified signature ^[18].

Finding the boxes is a separate job. According to the bulletin, edge devices like these often sit unnoticed in outlying warehouses, cold stores and collection points, and on machines ^[19]. For remote maintenance it also flags vulnerabilities in TeamViewer ^[22]. Ransomware activity against the industrial sector remains high, according to Industrial Cyber as cited in the bulletin ^[21].