{"id":29524,"date":"2026-10-27T10:55:48","date_gmt":"2026-10-27T09:55:48","guid":{"rendered":"https:\/\/cirosec.de\/?p=29524"},"modified":"2026-10-27T13:09:29","modified_gmt":"2026-10-27T12:09:29","slug":"hiding-your-netscaler-from-mass-exploitation-with-sni","status":"publish","type":"post","link":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/","title":{"rendered":"Hiding your NetScaler from mass exploitation with SNI"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"29524\" class=\"elementor elementor-29524\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2d3f9a70 elementor-section-full_width elementor-section-content-middle elementor-section-height-default elementor-section-height-default\" data-id=\"2d3f9a70\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-163b1ab6\" data-id=\"163b1ab6\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6edbe993 elementor-widget elementor-widget-template\" data-id=\"6edbe993\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<header data-elementor-type=\"header\" data-elementor-id=\"6422\" class=\"elementor elementor-6422 elementor-941 elementor-941\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3c20b09 elementor-section-full_width elementor-section-content-middle elementor-section-height-default elementor-section-height-default\" data-id=\"3c20b09\" data-element_type=\"section\" data-e-type=\"section\" id=\"header--sticky\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;sticky&quot;:&quot;top&quot;,&quot;sticky_on&quot;:[&quot;desktop&quot;,&quot;tablet_extra&quot;],&quot;sticky_offset&quot;:0,&quot;sticky_effects_offset&quot;:0,&quot;sticky_anchor_link_offset&quot;:0}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-2c6b6ea\" data-id=\"2c6b6ea\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-920f2b0 elementor-widget elementor-widget-theme-site-logo elementor-widget-image\" data-id=\"920f2b0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-site-logo.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/en\/\">\n\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"626\" height=\"188\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-full size-full wp-image-5868 lazyload\" alt=\"\" sizes=\"(max-width: 626px) 100vw, 626px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png 626w, https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent-300x90.png 300w\">\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-b85d260\" data-id=\"b85d260\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-db0098d elementor-widget__width-auto elementor-hidden-desktop elementor-widget elementor-widget-shortcode\" data-id=\"db0098d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n<div role=\"navigation\" aria-label=\"Language Switcher\" class=\"wpml-ls-statics-shortcode_actions wpml-ls wpml-ls-legacy-dropdown-click js-wpml-ls-legacy-dropdown-click\">\n\t<ul>\n\n\t\t<li class=\" wpml-ls-item-legacy-dropdown-click\">\n\n\t\t\t\t\t\t\t\t\t<a href=\"#\" hreflang=\"\" lang=\"\" class=\"js-wpml-ls-item-toggle wpml-ls-item-toggle\" aria-current=\"page\" aria-expanded=\"false\" aria-controls=\"wpml-ls-submenu-click-default\" aria-haspopup=\"true\" aria-label=\"Language switcher, click to open then tab to navigate\" tabindex=\"0\" role=\"button\" title=\"\">\n\t\t\t\t<\/a>\n\n\t\t\t<ul id=\"wpml-ls-submenu-click-default\" class=\"js-wpml-ls-sub-menu wpml-ls-sub-menu\">\n\t\t\t\t\n\t\t\t\t\t<li class=\"wpml-ls-slot-shortcode_actions wpml-ls-item wpml-ls-item-de wpml-ls-first-item wpml-ls-last-item\">\n\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/\" hreflang=\"de\" lang=\"de\" class=\"wpml-ls-link\" aria-label=\"Switch to German\" title=\"Switch to German\">\n\t\t\t\t\t\t\t                                    <img decoding=\"async\" class=\"wpml-ls-flag lazyload\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" alt=\"German\" loading=\"lazy\" width=\"15\" height=\"9\" data-src=\"https:\/\/cirosec.de\/wp-content\/plugins\/sitepress-multilingual-cms\/res\/flags\/de.svg\"><\/a>\n\t\t\t\t\t<\/li>\n\n\t\t\t\t\t\t\t<\/ul>\n\n\t\t<\/li>\n\n\t<\/ul>\n<\/div>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-65a0be9 elementor-widget__width-initial elementor-widget-tablet__width-initial elementor-nav-menu--dropdown-mobile elementor-nav-menu--stretch elementor-nav-menu__align-start elementor-widget-mobile__width-auto elementor-hidden-tablet elementor-hidden-mobile elementor-hidden-tablet_extra elementor-hidden-mobile_extra elementor-widget-mobile_extra__width-initial elementor-nav-menu__text-align-aside elementor-nav-menu--toggle elementor-nav-menu--burger elementor-widget elementor-widget-nav-menu\" data-id=\"65a0be9\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;full_width&quot;:&quot;stretch&quot;,&quot;layout&quot;:&quot;horizontal&quot;,&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-caret-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;toggle&quot;:&quot;burger&quot;}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-horizontal e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-65a0be9\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-7077\"><a href=\"https:\/\/cirosec.de\/en\/\" class=\"elementor-item\">cirosec<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-16136\"><a href=\"#\" class=\"elementor-item elementor-item-anchor\">Services<span class=\"sub-arrow\"><i class=\"fas fa-caret-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-15941\"><a href=\"https:\/\/cirosec.de\/en\/services\/\" class=\"elementor-sub-item\">Overview<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9131\"><a href=\"https:\/\/cirosec.de\/en\/services\/consulting-concepts-reviews-and-analyses\/\" class=\"elementor-sub-item\">Consulting, Concepts, Reviews and Analyses<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9073\"><a href=\"https:\/\/cirosec.de\/en\/services\/penetration-tests\/\" class=\"elementor-sub-item\">Penetration Tests<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9077\"><a href=\"https:\/\/cirosec.de\/en\/services\/red-team-assessments\/\" class=\"elementor-sub-item\">Red Team Assessments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9076\"><a href=\"https:\/\/cirosec.de\/en\/services\/incident-response-and-forensics\/\" class=\"elementor-sub-item\">Incident Response and Forensics<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-26842\"><a href=\"https:\/\/cirosec.de\/en\/services\/security-management-and-compliance\/\" class=\"elementor-sub-item\">Sec\u00adurity Manag\u00adement and Comp\u00adliance<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9075\"><a href=\"https:\/\/cirosec.de\/en\/services\/selection-implementation-of-products-and-solutions\/\" class=\"elementor-sub-item\">Implementation of Products and Solutions<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9078\"><a href=\"https:\/\/cirosec.de\/en\/services\/it-security-training-and-awareness\/\" class=\"elementor-sub-item\">Trainings and Awareness<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-16137\"><a href=\"#\" class=\"elementor-item elementor-item-anchor\">Trainings<span class=\"sub-arrow\"><i class=\"fas fa-caret-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-15940\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/\" class=\"elementor-sub-item\">Overview<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9092\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/malware-and-ransomware-background-detection-protection-and-response\/\" class=\"elementor-sub-item\">Malware and Ransomware \u2013 Background, Detection, Protection and Response<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9095\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-microsoft-365\/\" class=\"elementor-sub-item\">Security in Microsoft 365<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9083\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-and-hardening-of-windows-operating-systems\/\" class=\"elementor-sub-item\">Hacking and Hardening of Windows Operating Systems<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9082\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-and-hardening-of-windows-infrastructures\/\" class=\"elementor-sub-item\">Hacking and Hardening of Windows Infrastructures<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9084\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme\/\" class=\"elementor-sub-item\">Hacking Extreme<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9086\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme-web-applications\/\" class=\"elementor-sub-item\">Hacking Extreme Web Applications<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9080\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/crash-course-it-and-information-security\/\" class=\"elementor-sub-item\">Crash Course IT and Information Security<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-13051\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/nis2-information-security-for-chief-executive-officers\/\" class=\"elementor-sub-item\">NIS 2 Training for Management<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9087\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/incident-handling-response\/\" class=\"elementor-sub-item\">Incident Handling &amp; Response<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28734\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/kunstliche-intelligenz-und-it-sicherheit\/\" class=\"elementor-sub-item\">Artificial Intelligence and IT Security<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-26257\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/training-in-immediate-measures\/\" class=\"elementor-sub-item\">Training in Imm\u00adediate Mea\u00adsures<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28773\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/ir-readiness-workshop\/\" class=\"elementor-sub-item\">IR Readi\u00adness Work\u00adshop<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28806\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/incident-response-using-microsoft-defender\/\" class=\"elementor-sub-item\">Incident Response Using Microsoft Defender<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9094\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-azure-cloud-environments\/\" class=\"elementor-sub-item\">Security in Azure Cloud Environments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9089\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/iso-27001-lead-implementer\/\" class=\"elementor-sub-item\">ISO 27001 Lead Implementer<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9088\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/iso-27001-lead-auditor\/\" class=\"elementor-sub-item\">ISO 27001 Lead Auditor<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9081\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/forensics-extreme\/\" class=\"elementor-sub-item\">Forensics Extreme<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9093\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-aws-cloud-environments\/\" class=\"elementor-sub-item\">Security in AWS Cloud Environments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9091\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/it-security-for-strategists-and-managers\/\" class=\"elementor-sub-item\">IT Security for Strategists and Managers<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9090\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/it-security-for-developers\/\" class=\"elementor-sub-item\">IT Security for Developers<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9085\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme-buffer-overflows\/\" class=\"elementor-sub-item\">Hacking Extreme Buffer Overflows<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9064\"><a href=\"https:\/\/cirosec.de\/en\/about-us\/\" class=\"elementor-item\">About us<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9160\"><a href=\"https:\/\/cirosec.de\/en\/blog\/\" class=\"elementor-item\">Blog<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t<div class=\"elementor-menu-toggle\" role=\"button\" tabindex=\"0\" aria-label=\"Menu Toggle\" aria-expanded=\"false\">\n\t\t\t<i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--open eicon-menu-bar\"><\/i><i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--close eicon-close\"><\/i>\t\t<\/div>\n\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-65a0be9\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-7077\"><a href=\"https:\/\/cirosec.de\/en\/\" class=\"elementor-item\" tabindex=\"-1\">cirosec<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-16136\"><a href=\"#\" class=\"elementor-item elementor-item-anchor\" tabindex=\"-1\">Services<span class=\"sub-arrow\"><i class=\"fas fa-caret-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-15941\"><a href=\"https:\/\/cirosec.de\/en\/services\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Overview<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9131\"><a href=\"https:\/\/cirosec.de\/en\/services\/consulting-concepts-reviews-and-analyses\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Consulting, Concepts, Reviews and Analyses<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9073\"><a href=\"https:\/\/cirosec.de\/en\/services\/penetration-tests\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Penetration Tests<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9077\"><a href=\"https:\/\/cirosec.de\/en\/services\/red-team-assessments\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Red Team Assessments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9076\"><a href=\"https:\/\/cirosec.de\/en\/services\/incident-response-and-forensics\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Incident Response and Forensics<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-26842\"><a href=\"https:\/\/cirosec.de\/en\/services\/security-management-and-compliance\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Sec\u00adurity Manag\u00adement and Comp\u00adliance<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9075\"><a href=\"https:\/\/cirosec.de\/en\/services\/selection-implementation-of-products-and-solutions\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Implementation of Products and Solutions<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9078\"><a href=\"https:\/\/cirosec.de\/en\/services\/it-security-training-and-awareness\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Trainings and Awareness<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-16137\"><a href=\"#\" class=\"elementor-item elementor-item-anchor\" tabindex=\"-1\">Trainings<span class=\"sub-arrow\"><i class=\"fas fa-caret-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-15940\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Overview<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9092\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/malware-and-ransomware-background-detection-protection-and-response\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Malware and Ransomware \u2013 Background, Detection, Protection and Response<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9095\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-microsoft-365\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Security in Microsoft 365<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9083\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-and-hardening-of-windows-operating-systems\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Hacking and Hardening of Windows Operating Systems<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9082\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-and-hardening-of-windows-infrastructures\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Hacking and Hardening of Windows Infrastructures<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9084\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Hacking Extreme<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9086\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme-web-applications\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Hacking Extreme Web Applications<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9080\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/crash-course-it-and-information-security\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Crash Course IT and Information Security<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-13051\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/nis2-information-security-for-chief-executive-officers\/\" class=\"elementor-sub-item\" tabindex=\"-1\">NIS 2 Training for Management<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9087\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/incident-handling-response\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Incident Handling &amp; Response<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28734\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/kunstliche-intelligenz-und-it-sicherheit\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Artificial Intelligence and IT Security<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-26257\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/training-in-immediate-measures\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Training in Imm\u00adediate Mea\u00adsures<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28773\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/ir-readiness-workshop\/\" class=\"elementor-sub-item\" tabindex=\"-1\">IR Readi\u00adness Work\u00adshop<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-28806\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/incident-response-using-microsoft-defender\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Incident Response Using Microsoft Defender<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9094\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-azure-cloud-environments\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Security in Azure Cloud Environments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9089\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/iso-27001-lead-implementer\/\" class=\"elementor-sub-item\" tabindex=\"-1\">ISO 27001 Lead Implementer<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9088\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/iso-27001-lead-auditor\/\" class=\"elementor-sub-item\" tabindex=\"-1\">ISO 27001 Lead Auditor<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9081\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/forensics-extreme\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Forensics Extreme<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9093\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/security-in-aws-cloud-environments\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Security in AWS Cloud Environments<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9091\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/it-security-for-strategists-and-managers\/\" class=\"elementor-sub-item\" tabindex=\"-1\">IT Security for Strategists and Managers<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9090\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/it-security-for-developers\/\" class=\"elementor-sub-item\" tabindex=\"-1\">IT Security for Developers<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9085\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/hacking-extreme-buffer-overflows\/\" class=\"elementor-sub-item\" tabindex=\"-1\">Hacking Extreme Buffer Overflows<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9064\"><a href=\"https:\/\/cirosec.de\/en\/about-us\/\" class=\"elementor-item\" tabindex=\"-1\">About us<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9160\"><a href=\"https:\/\/cirosec.de\/en\/blog\/\" class=\"elementor-item\" tabindex=\"-1\">Blog<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ee7d03 elementor-widget-mobile__width-auto elementor-hidden-desktop elementor-widget-tablet_extra__width-auto elementor-widget-tablet__width-auto elementor-widget-mobile_extra__width-auto elementor-view-default elementor-widget elementor-widget-icon\" data-id=\"9ee7d03\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-icon-wrapper\">\n\t\t\t<a class=\"elementor-icon\" href=\"#elementor-action%3Aaction%3Dpopup%3Aopen%26settings%3DeyJpZCI6MTI1MDcsInRvZ2dsZSI6ZmFsc2V9\">\n\t\t\t<i aria-hidden=\"true\" class=\"fas fa-bars\"><\/i>\t\t\t<\/a>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-9aaaa68 elementor-hidden-tablet elementor-hidden-mobile elementor-hidden-tablet_extra elementor-hidden-mobile_extra\" data-id=\"9aaaa68\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-eb812f4 elementor-widget__width-auto elementor-hidden-tablet elementor-hidden-mobile elementor-widget elementor-widget-shortcode\" data-id=\"eb812f4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n<div role=\"navigation\" aria-label=\"Language Switcher\" class=\"wpml-ls-statics-shortcode_actions wpml-ls wpml-ls-legacy-dropdown-click js-wpml-ls-legacy-dropdown-click\">\n\t<ul>\n\n\t\t<li class=\" wpml-ls-item-legacy-dropdown-click\">\n\n\t\t\t\t\t\t\t\t\t<a href=\"#\" hreflang=\"\" lang=\"\" class=\"js-wpml-ls-item-toggle wpml-ls-item-toggle\" aria-current=\"page\" aria-expanded=\"false\" aria-controls=\"wpml-ls-submenu-click-default\" aria-haspopup=\"true\" aria-label=\"Language switcher, click to open then tab to navigate\" tabindex=\"0\" role=\"button\" title=\"\">\n\t\t\t\t<\/a>\n\n\t\t\t<ul id=\"wpml-ls-submenu-click-default\" class=\"js-wpml-ls-sub-menu wpml-ls-sub-menu\">\n\t\t\t\t\n\t\t\t\t\t<li class=\"wpml-ls-slot-shortcode_actions wpml-ls-item wpml-ls-item-de wpml-ls-first-item wpml-ls-last-item\">\n\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/\" hreflang=\"de\" lang=\"de\" class=\"wpml-ls-link\" aria-label=\"Switch to German\" title=\"Switch to German\">\n\t\t\t\t\t\t\t                                    <img decoding=\"async\" class=\"wpml-ls-flag lazyload\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" alt=\"German\" loading=\"lazy\" width=\"15\" height=\"9\" data-src=\"https:\/\/cirosec.de\/wp-content\/plugins\/sitepress-multilingual-cms\/res\/flags\/de.svg\"><\/a>\n\t\t\t\t\t<\/li>\n\n\t\t\t\t\t\t\t<\/ul>\n\n\t\t<\/li>\n\n\t<\/ul>\n<\/div>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d5c65bb elementor-search-form--skin-minimal elementor-widget__width-auto elementor-hidden-tablet elementor-hidden-mobile elementor-widget elementor-widget-search-form\" data-id=\"d5c65bb\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;skin&quot;:&quot;minimal&quot;}\" data-widget_type=\"search-form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<search role=\"search\">\n\t\t\t<form class=\"elementor-search-form\" action=\"https:\/\/cirosec.de\/en\/\" method=\"get\">\n\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-search-form__container\">\n\t\t\t\t\t<label class=\"elementor-screen-only\" for=\"elementor-search-form-d5c65bb\">Search<\/label>\n\n\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-search-form__icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-search\"><\/i>\t\t\t\t\t\t\t<span class=\"elementor-screen-only\">Search<\/span>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\n\t\t\t\t\t<input id=\"elementor-search-form-d5c65bb\" placeholder=\"Search...\" class=\"elementor-search-form__input\" type=\"search\" name=\"s\" value=\"\">\n\t\t\t\t\t<input type='hidden' name='lang' value='en' \/>\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/form>\n\t\t<\/search>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-071bdb7 elementor-hidden-tablet elementor-hidden-mobile elementor-hidden-tablet_extra elementor-hidden-mobile_extra\" data-id=\"071bdb7\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4d21fed elementor-widget elementor-widget-button\" data-id=\"4d21fed\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/cirosec.de\/en\/inquiry\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Send enquiry<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-9865c47 e-flex e-con-boxed e-con e-parent\" data-id=\"9865c47\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4efe62d elementor-widget elementor-widget-html\" data-id=\"4efe62d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script>\n\ndocument.addEventListener('DOMContentLoaded', function() {\njQuery(function($) {\nvar mywindow = $(window);\nvar mypos = mywindow.scrollTop();\nlet scrolling = false;\nwindow.addEventListener('scroll', function() {\nscrolling = true;\n});\nsetInterval(() => {\nif (scrolling) {\nscrolling = false;\nif (mypos > 40) {\nif (mywindow.scrollTop() > mypos) {\n$('#header--sticky').addClass('headerup');\n} else {\n$('#header--sticky').removeClass('headerup');\n}\n}\nmypos = mywindow.scrollTop();\n}\n}, 300);\n});\n});\n\n<\/script>\n<style>\n#header--sticky{\ntransition : transform 0.34s ease;\n}\n.headerup{\ntransform: translateY(-110px); \/*adjust this value to the height of your header*\/\n}\n<\/style>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/header>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-191ac63b elementor-reverse-mobile elementor-section-height-min-height elementor-section-items-stretch elementor-section-boxed elementor-section-height-default\" data-id=\"191ac63b\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-no\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-32667a22\" data-id=\"32667a22\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7c86c837 elementor-widget elementor-widget-post-info\" data-id=\"7c86c837\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-inline-items elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-59da575 elementor-inline-item\" itemprop=\"about\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-terms\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-post-info__terms-list\">\n\t\t\t\t<span class=\"elementor-post-info__terms-list-item\">Incident Response<\/span>, <span class=\"elementor-post-info__terms-list-item\">Pentesting<\/span>\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-15fa2c7c elementor-widget elementor-widget-heading\" data-id=\"15fa2c7c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Hiding your NetScaler from mass exploitation with SNI<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-318e8bbe elementor-widget elementor-widget-spacer\" data-id=\"318e8bbe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-52b95695 elementor-widget elementor-widget-text-editor\" data-id=\"52b95695\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>October 27, 2026<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-1697c7ba elementor-hidden-mobile_extra elementor-hidden-mobile\" data-id=\"1697c7ba\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-104eb0ce elementor-widget elementor-widget-spacer\" data-id=\"104eb0ce\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1053a51b elementor-reverse-mobile elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1053a51b\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-6e82540c\" data-id=\"6e82540c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6c64fc0 elementor-widget elementor-widget-menu-anchor\" data-id=\"6c64fc0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"section1\"><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-161ebd86 elementor-widget elementor-widget-heading\" data-id=\"161ebd86\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">SNI or it didn't happen: Hiding your NetScaler from mass exploitation<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3131f129 elementor-widget elementor-widget-text-editor\" data-id=\"3131f129\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>TL;DR<\/h2><ul><li>CVE-2026-88771 and CVE-2026-88772 were exploited for up to three weeks before Citrix&#8217;s bulletin was released on September 27, 2026. CVE-2026-88779 followed a week later, also exploited before disclosure. When Citrix issued its warning, many appliances had already been compromised.<\/li><li>In cirosec&#8217;s incident response cases, attackers mass-scanned IP addresses and fired the exploits at every NetScaler that answered.<\/li><li>By default, a NetScaler SSL vserver answers anyone who connects to its IP address. It returns its certificate, and with it the hostname, and serves content for any SNI or Host<\/li><li>SNI-only certificate bindings with SNI enforcement in a custom SSL profile close this gap, optionally plus an SSL policy that resets every ClientHello without the correct hostname. An IP-based scanner then gets no certificate and nothing that looks like a NetScaler and moves on.<\/li><li>Verify the result with our open-source tool <a href=\"https:\/\/github.com\/cirosec\/SNItch\" target=\"_blank\" rel=\"noopener\">SNItch<\/a>.<\/li><li>Caveat: Certificate Transparency logs publish your hostname. A new, non-obvious hostname with a wildcard certificate keeps it out.<\/li><\/ul><h2>Introduction<\/h2><p>For up to three weeks this September, attackers exploited NetScaler appliances that no patch, no CVE and no detection rule could protect. When Citrix published bulletin <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697096\" target=\"_blank\" rel=\"noopener\">CTX697096<\/a> [11] on September 27, 2026, its two critical remote code execution flaws were already in use as zero-days: <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88771\" target=\"_blank\" rel=\"noopener\">CVE-2026-88771<\/a> (<a href=\"https:\/\/labs.watchtowr.com\/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771\/\" target=\"_blank\" rel=\"noopener\">unauthenticated command injection<\/a> [9]) and <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88772\" target=\"_blank\" rel=\"noopener\">CVE-2026-88772<\/a> (<a href=\"https:\/\/labs.watchtowr.com\/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772\/\" target=\"_blank\" rel=\"noopener\">pre-auth memory overflow in DTLS<\/a> [10]) [1][13]. A week later, <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88779\" target=\"_blank\" rel=\"noopener\">CVE-2026-88779<\/a> followed with bulletin <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697174\" target=\"_blank\" rel=\"noopener\">CTX697174<\/a> [12]: a SAML memory overflow that <a href=\"https:\/\/www.securityweek.com\/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier\/\" target=\"_blank\" rel=\"noopener\">crashed even freshly patched appliances<\/a>, again exploited before disclosure [2].<\/p><p><a href=\"https:\/\/www.esentire.com\/security-advisories\/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772\" target=\"_blank\" rel=\"noopener\">eSentire<\/a> saw CVE-2026-88771 exploited from September 5, Google GTIG and Mandiant date CVE-2026-88772 exploitation to early September [5]. <a href=\"https:\/\/www.rapid7.com\/blog\/post\/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\/\" target=\"_blank\" rel=\"noopener\">Rapid7<\/a>, <a href=\"https:\/\/www.greynoise.io\/blog\/swarming-against-citrix-0-day-exploitation\" target=\"_blank\" rel=\"noopener\">GreyNoise<\/a> and <a href=\"https:\/\/www.crowdsec.net\/vulntracking-report\/cve-2026-88771-citrix-netscaler-pre-auth-command-injection\" target=\"_blank\" rel=\"noopener\">CrowdSec<\/a> recorded attempts between September 20 and 24 [3][4][5]. Any NetScaler that was reachable from the Internet in that window had to be treated as potentially compromised. Where logging was left in the default state, the logs got rotated out before the investigation even started.<\/p><p>In incident response cases where cirosec was involved, the attackers swept entire address ranges and attacked anything around September 20 that looked like a NetScaler by directly contacting the IP address.<\/p><p>That, oddly, is good news, because you can do something about it. A NetScaler that only talks to clients who know its hostname gives an IP-based mass scan nothing to work with.<\/p><p>In this blog post, we show how to make a NetScaler reject every TLS connection without the correct hostname, how to verify this with <a href=\"https:\/\/github.com\/cirosec\/SNItch\" target=\"_blank\" rel=\"noopener\">SNItch<\/a> and where the approach reaches its limits.<\/p><h2>Your NetScaler talks to strangers<\/h2><p>When a browser connects to gateway.example.com, it puts the hostname into the TLS ClientHello as the <em>Server Name Indication<\/em> (SNI, RFC 6066), and the server uses it to pick the certificate. A mass scanner connecting to X.X.X.X:443 sends no SNI or a random one.<\/p><p>A default NetScaler SSL vserver does not care. It completes the handshake, presents its default certificate and serves content, whatever SNI or Host header arrives. The certificate&#8217;s CN\/SAN tells the scanner exactly what host it found. Shodan and <a href=\"https:\/\/platform.censys.io\/search?q=%28host.services.software.vendor+%3D+%22citrix%22+or+web.software.vendor+%3D+%22citrix%22%29+and+%28host.services.software.product+%3D+%22netscaler%22+or+web.software.product+%3D+%22netscaler%22%29\" target=\"_blank\" rel=\"noopener\">Censys<\/a> index this. So do attackers&#8217; scanners. This is a common problem with many improperly configured Internet-facing servers.<\/p><p>You can see how an attacker sees an unhardened Citrix NetScaler host (X.X.X.28:443) in SNItch and Censys:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-185afd7e\" data-id=\"185afd7e\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8cc00f0 elementor-position-top elementor-widget elementor-widget-image-box\" data-id=\"8cc00f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><figure class=\"elementor-image-box-img\"><a href=\"https:\/\/cirosec.de\/en\/news\/author\/felix-friedberger\/\" tabindex=\"-1\"><img decoding=\"async\" width=\"640\" height=\"640\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-full size-full wp-image-24607 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2025\/11\/Felix-Friedberger_Teams_PB.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2025\/11\/Felix-Friedberger_Teams_PB.jpg 640w, https:\/\/cirosec.de\/wp-content\/uploads\/2025\/11\/Felix-Friedberger_Teams_PB-300x300.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2025\/11\/Felix-Friedberger_Teams_PB-150x150.jpg 150w\"><\/a><\/figure><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\"><a href=\"https:\/\/cirosec.de\/en\/news\/author\/felix-friedberger\/\">Felix Friedberger<\/a><\/div><p class=\"elementor-image-box-description\">Consultant<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-52f398ca elementor-widget elementor-widget-heading\" data-id=\"52f398ca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Category<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac83b53 elementor-widget elementor-widget-post-info\" data-id=\"ac83b53\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-59da575\" itemprop=\"about\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-terms\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-post-info__terms-list\">\n\t\t\t\t<span class=\"elementor-post-info__terms-list-item\">Incident Response<\/span>, <span class=\"elementor-post-info__terms-list-item\">Pentesting<\/span>\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5083b109 elementor-widget elementor-widget-heading\" data-id=\"5083b109\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Date<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4d8fc802 elementor-widget elementor-widget-post-info\" data-id=\"4d8fc802\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-59da575\" itemprop=\"datePublished\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-date\">\n\t\t\t\t\t\t\t\t\t\t<time>2026-10-27<\/time>\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-248c560e elementor-widget elementor-widget-heading\" data-id=\"248c560e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Navigation<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1eb0082c elementor-widget elementor-widget-table-of-contents\" data-id=\"1eb0082c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;headings_by_tags&quot;:[&quot;h2&quot;,&quot;h3&quot;,&quot;h4&quot;],&quot;exclude_headings_by_selector&quot;:[],&quot;marker_view&quot;:&quot;bullets&quot;,&quot;icon&quot;:{&quot;value&quot;:&quot;fas fa-chevron-right&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;no_headings_message&quot;:&quot;No headings were found on this page.&quot;,&quot;hierarchical_view&quot;:&quot;yes&quot;,&quot;min_height&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"table-of-contents.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div id=\"elementor-toc__1eb0082c\" class=\"elementor-toc__body\">\n\t\t\t<div class=\"elementor-toc__spinner-container\">\n\t\t\t\t<i class=\"elementor-toc__spinner eicon-animation-spin eicon-loading\" aria-hidden=\"true\"><\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-15375e74 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"15375e74\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-66953269\" data-id=\"66953269\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6937d755 elementor-widget elementor-widget-image\" data-id=\"6937d755\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"SNItch_censored\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6Mjk1MTksInVybCI6Imh0dHBzOlwvXC9jaXJvc2VjLmRlXC93cC1jb250ZW50XC91cGxvYWRzXC8yMDI2XC8xMFwvU05JdGNoX2NlbnNvcmVkLnBuZyJ9\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"640\" height=\"291\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium_large size-medium_large wp-image-29519 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored-768x349.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored-768x349.png 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored-300x136.png 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored-1024x465.png 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_censored.png 1240w\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\"><\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6e2e6aa elementor-widget elementor-widget-image\" data-id=\"6e2e6aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Censys_censored\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6Mjk1MTUsInVybCI6Imh0dHBzOlwvXC9jaXJvc2VjLmRlXC93cC1jb250ZW50XC91cGxvYWRzXC8yMDI2XC8xMFwvQ2Vuc3lzX2NlbnNvcmVkLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"355\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium_large size-medium_large wp-image-29515 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored-768x426.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored-768x426.png 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored-300x166.png 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored-1024x568.png 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored-1536x852.png 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_censored.png 1656w\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Figure 1: In both cases, using just the IP as input, an attacker gets a valid response from the server. Hence the attacker can clearly see that the system is a Citrix NetScaler and on what domain it is located.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bee36ce elementor-widget elementor-widget-menu-anchor\" data-id=\"bee36ce\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"info-event\"><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2d52387c elementor-widget elementor-widget-menu-anchor\" data-id=\"2d52387c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"section2\"><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-633c91b4 elementor-widget elementor-widget-text-editor\" data-id=\"633c91b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>We tested the behavior in our lab on NetScaler CPX 13.0-90.7 and 14.1-73.30:<\/p><table><thead><tr><td width=\"272\"><strong>Client sends<\/strong><\/td><td width=\"352\"><strong>Default NetScaler<\/strong><\/td><\/tr><\/thead><tbody><tr><td width=\"272\">No SNI (connect to the IP)<\/td><td width=\"352\">Handshake OK, certificate served, HTTP 200<\/td><\/tr><tr><td width=\"272\">Wrong SNI (wrong.example)<\/td><td width=\"352\">Handshake OK, certificate served, HTTP 200<\/td><\/tr><tr><td width=\"272\">Correct SNI, different Host header<\/td><td width=\"352\">HTTP 200<\/td><\/tr><\/tbody><\/table><p><em>Table 1: Behavior of a default NetScaler SSL vserver<\/em><\/p><h2>Step 0: Switch to SSL profiles<\/h2><p>NetScaler configures SSL in one of two modes. In <em>legacy mode<\/em>, every setting lives on the vserver. In <em>default SSL profile mode<\/em>, the settings move into profiles that vservers reference, while certificate bindings and SSL policies stay on the vserver. The NetScaler documentation describes profiles as a <a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/ssl\/ssl-profiles.html\" target=\"_blank\" rel=\"noopener\">single point of SSL configuration<\/a> for all related endpoints, so we use profile mode throughout. We verified the full setup on 14.1-73.30.<\/p><p>The switch affects every SSL vserver and service on the appliance. Switching back can also be tricky, as there is no simple command to disable profile mode again. Back up your configuration, schedule a maintenance window and check the documentation for your release:<\/p><pre>set ssl parameter -defaultProfile ENABLED<\/pre><p>Until you assign a custom profile, every SSL vserver falls back to the built-in<\/p><pre> ns_default_ssl_profile_frontend, <\/pre><p>which still enables TLS 1.0\/1.1 and disables TLS 1.3.<\/p><h2>Step 1: Bind certificates as SNI certificates only<\/h2><p>The idea, as <a href=\"https:\/\/norz.at\/?p=2419\" target=\"_blank\" rel=\"noopener\">described by Johannes Norz<\/a> [6], is simple: if the vserver has no default certificate, a client without a matching SNI gets nothing. The default certificate is any certificate bound to the vserver without -SNICert. In production, that is usually your gateway certificate, such as gw-rsa and gw-ec in our lab. If someone bound the self-signed ns-server-certificate for testing, it counts as well, so unbind every non-SNI certificate, not just the ones in our example. The files are located in \/nsconfig\/ssl\/; the vserver binding decides which one is served.<\/p><p>All commands in this post use placeholder values: replace gateway.example.com, X.X.X.X, vs_tls and the certificate names gw-rsa\/gw-ec with your own.<\/p><p>Create a front-end profile with SNI enforcement, assign it to the vserver and rebind the certificates with -SNICert:<\/p><pre># Frontend profile: SNI on, unknown SNI refused, Host header must match the SNI<br \/>add ssl profile sslp_fe_hardened -sslProfileType FrontEnd<br \/>set ssl profile sslp_fe_hardened -SNIEnable ENABLED -allowUnknownSNI DISABLED<br \/>set ssl profile sslp_fe_hardened -SNIHTTPHostMatch STRICT<br \/>set ssl profile sslp_fe_hardened -dropReqWithNoHostHeader YES<br \/><br \/># Vserver: reference the profile, bind certificates as SNI certificates only<br \/>set\u00a0\u00a0\u00a0 ssl vserver vs_tls -sslProfile sslp_fe_hardened<br \/>unbind ssl vserver vs_tls -certkeyName gw-rsa<br \/>unbind ssl vserver vs_tls -certkeyName gw-ec<br \/>bind\u00a0\u00a0 ssl vserver vs_tls -certkeyName gw-rsa -SNICert<br \/>bind\u00a0\u00a0 ssl vserver vs_tls -certkeyName gw-ec\u00a0 -SNICert<\/pre><p>RSA and ECDSA certificates can be bound side by side; NetScaler picks one per negotiated cipher.<\/p><p>The certificate binding is the control that does the SNI magic. But be aware: in our tests, a single non-SNI certificate bound next to the SNI certificates was sufficient: clients without SNI received it and got an HTTP 200 response, regardless of &#8211;<em>allowUnknownSNI<\/em> <em>DISABLED<\/em> or &#8211;<em>defaultSni<\/em>. We still set -allowUnknownSNI DISABLED as defense in depth. Check every Internet-facing vserver with show ssl vserver vs_tls: each certificate line must read <em>Server Certificate for SNI<\/em>.<\/p><p>-SNIHTTPHostMatch STRICT rejects requests whose Host header differs from the SNI with HTTP 400, even for another name on the same certificate (the default, CERT, allows other SANs). -dropReqWithNoHostHeader YES rejects HTTP\/1.0 requests without a Host header.<\/p><p>With Step 1 alone, a connection without SNI fails with TLS alert 40 (handshake_failure) and a wrong SNI with alert 112 (unrecognized_name). No certificate leaves the appliance, so the hostname stays hidden and direct connections to the IP address are refused. For most setups, that already does the job.<\/p><p><strong>Side note: legacy SSL mode.<\/strong> Can&#8217;t switch to profile mode yet? The same protection works in legacy mode, with SNI enabled directly on the vserver. Certificate bindings and the ClientHello policy are identical, and in our tests a Host header that did not match the SNI was still rejected with HTTP 400.<\/p><pre>set\u00a0\u00a0\u00a0 ssl vserver vs_tls -SNIEnable ENABLED<br \/>unbind ssl vserver vs_tls -certkeyName gw-rsa<br \/>unbind ssl vserver vs_tls -certkeyName gw-ec<br \/>bind\u00a0\u00a0 ssl vserver vs_tls -certkeyName gw-rsa -SNICert<br \/>bind\u00a0\u00a0 ssl vserver vs_tls -certkeyName gw-ec\u00a0 -SNICert<\/pre><p>Once profile mode is enabled, these vserver commands are refused (&#8220;Use set ssl profile&#8221;).<\/p><h2>Step 2: Reset everything else at the ClientHello (optional)<\/h2><p>Step 1 hides the hostname, but the TLS alerts still tell a scanner <em>\u201cTLS service with SNI enforcement here\u201d<\/em>. That is a fingerprint, and automated tooling may start guessing hostnames. We can remove it.<\/p><p>An SSL policy evaluated at the ClientHello can answer with a plain TCP reset instead. A port scanner still sees the port as open, but no TLS handshake ever completes, so there is nothing to identify it as a NetScaler. In profile mode, SSL policies are still bound to the vserver:<\/p><pre>add ssl policy pol_sni_reset -rule \"CLIENT.SSL.CLIENT_HELLO.SNI.SET_TEXT_MODE(IGNORECASE).EQ(\\\"gateway.example.com\\\").NOT\" -action RESET<br \/>bind ssl vserver vs_tls -policyName pol_sni_reset -priority 10 -type CLIENTHELLO_REQ<\/pre><p>To allow more than one hostname, chain them with .OR(&#8230;) or use a pattern set instead of the single-host rule:<\/p><pre>add policy patset ps_allowed_sni<br \/>bind policy patset ps_allowed_sni gateway.example.com<br \/>bind policy patset ps_allowed_sni gateway2.example.com<br \/>add ssl policy pol_sni_reset -rule \"CLIENT.SSL.CLIENT_HELLO.SNI.SET_TEXT_MODE(IGNORECASE).EQUALS_ANY(\\\"ps_allowed_sni\\\").NOT\" -action RESET<\/pre><p>Each new hostname needs two changes: bind its certificate with -SNICert and add the name to the pol_sni_reset rule or pattern set. Otherwise, clients get a TCP reset. Keep Step 1 in place, too. In our lab, an IP address sent as SNI slipped past the second policy, but the SNI-only certificate binding still rejected it.<\/p><table><thead><tr><td width=\"309\"><strong>Client sends<\/strong><\/td><td width=\"89\"><strong>Default<\/strong><\/td><td width=\"134\"><strong>Step 1<\/strong><\/td><td width=\"92\"><strong>Step 1 + 2<\/strong><\/td><\/tr><\/thead><tbody><tr><td width=\"309\">No SNI (connect to IP)<\/td><td width=\"89\">cert + 200<\/td><td width=\"134\">alert 40, no cert<\/td><td width=\"92\"><strong>TCP RST<\/strong><\/td><\/tr><tr><td width=\"309\">Correct SNI<\/td><td width=\"89\">200<\/td><td width=\"134\">200<\/td><td width=\"92\">200<\/td><\/tr><tr><td width=\"309\">Correct SNI, uppercase<\/td><td width=\"89\">200<\/td><td width=\"134\">200<\/td><td width=\"92\">200<\/td><\/tr><tr><td width=\"309\">Wrong SNI<\/td><td width=\"89\">cert + 200<\/td><td width=\"134\">alert 112<\/td><td width=\"92\"><strong>TCP RST<\/strong><\/td><\/tr><tr><td width=\"309\">Subdomain (sub.gateway.example.com)<\/td><td width=\"89\">cert + 200<\/td><td width=\"134\">alert 112<\/td><td width=\"92\"><strong>TCP RST<\/strong><\/td><\/tr><tr><td width=\"309\">IP literal as SNI<\/td><td width=\"89\">cert + 200<\/td><td width=\"134\">alert 112<\/td><td width=\"92\">alert 112<\/td><\/tr><tr><td width=\"309\">Correct SNI, other Host header<\/td><td width=\"89\">200<\/td><td width=\"134\">400<\/td><td width=\"92\">400<\/td><\/tr><\/tbody><\/table><p><em>Table 2: SNI test matrix, identical on CPX 13.0 and 14.1 and in profile mode on 14.1, plain numbers in cells mean HTTP status codes. Alert + &lt;number&gt; mean TLS errors, which in this case are good.<\/em><\/p><h2>Putting it all together<\/h2><p>The SNI hardening is meant as an addition to your existing TLS configuration, not a replacement for it. For protocols, ciphers and renegotiation, we recommend following Citrix&#8217;s official guide <a href=\"https:\/\/community.citrix.com\/tech-zone\/build\/tech-papers\/networking-tls-best-practices-2026\/\">Networking SSL\/TLS Best Practices<\/a> [8]. That guide does not configure SNI enforcement, so add Steps 1 and 2 on top of it.<\/p><p>The block below combines both: TLS settings aligned with Citrix&#8217;s guide, plus the SNI hardening from this post. Replace vs_tls, gw-rsa\/gw-ec and gateway.example.com with your own names:<\/p><pre># Global: switch to default SSL profile mode (one-way, affects all SSL vservers, see Step 0)<br \/>set ssl parameter -defaultProfile ENABLED<br \/># Cipher group: TLS 1.3 + ECDHE\/AEAD only<br \/>add ssl cipher CG_MODERN<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.3-AES256-GCM-SHA384<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.3-CHACHA20-POLY1305-SHA256<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.3-AES128-GCM-SHA256<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-ECDSA-CHACHA20-POLY1305<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-RSA-CHACHA20-POLY1305<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256<br \/>bind ssl cipher CG_MODERN -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256<br \/><br \/># Frontend profile: SNI enforcement (Step 1) + TLS hardening<br \/>add ssl profile sslp_fe_hardened -sslProfileType FrontEnd<br \/>set ssl profile sslp_fe_hardened -SNIEnable ENABLED<br \/>set ssl profile sslp_fe_hardened -SNIEnable ENABLED -allowUnknownSNI DISABLED<br \/>set ssl profile sslp_fe_hardened -SNIHTTPHostMatch STRICT -dropReqWithNoHostHeader YES<br \/>set ssl profile sslp_fe_hardened -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -tls12 ENABLED -tls13 ENABLED<br \/>set ssl profile sslp_fe_hardened -denySSLReneg FRONTEND_CLIENT<br \/>set ssl profile sslp_fe_hardened -HSTS ENABLED -maxage 31536000<br \/><br \/>unbind ssl profile sslp_fe_hardened -cipherName DEFAULT<br \/><br \/>bind ssl profile sslp_fe_hardened -cipherName CG_MODERN<br \/><br \/># Vserver: profile reference, SNI-only certificates (Step 1)<br \/>set ssl vserver vs_tls -sslProfile sslp_fe_hardened<br \/>unbind ssl vserver vs_tls -certkeyName gw-rsa<br \/>unbind ssl vserver vs_tls -certkeyName gw-ec<br \/>bind ssl vserver vs_tls -certkeyName gw-rsa -SNICert<br \/>bind ssl vserver vs_tls -certkeyName gw-ec -SNICert<br \/><br \/># ClientHello reset for wrong or missing SNI (Step 2)<br \/><br \/>add ssl policy pol_sni_reset -rule \"CLIENT.SSL.CLIENT_HELLO.SNI.SET_TEXT_MODE(IGNORECASE).EQ(\\\"gateway.example.com\\\").NOT\" -action RESET<br \/>bind ssl vserver vs_tls -policyName pol_sni_reset -priority 10 -type CLIENTHELLO_REQ<br \/>save ns config<br \/><br \/># Tested on NetScaler CPX 14.1-73.30 (NS14.1: Build 73.30.nc) and 13.1-63.19 (NS13.1: Build 63.19.nc), in default SSL profile mode.<\/pre><p>Before saving, run show ssl vserver vs_tls: every certificate line must read <em>Server Certificate for SNI<\/em>. If other vservers share the profile, show ssl profile sslp_fe_hardened lists them.<\/p><p>Do a small test with your gateway: if <em>curl https:\/\/X.X.X.X\/ -v<\/em> returns a TLS error or connection reset while <em>curl https:\/\/your-citrix-jde4.example.com -v<\/em> works fine, your changes were successful.<\/p><h2>Side effects and limitations<\/h2><ul><li><strong>Anything that connects by IP address only breaks.<\/strong> Health monitors, upstream load balancers, scripts and monitoring checks without SNI now fail (TLS alert, or TCP reset with Step 2). Use the proper hostname instead.<\/li><li><strong>Switching to profile mode is global.<\/strong> Every vserver without a custom profile falls back to ns_default_ssl_profile_frontend. Assign profiles to all vservers, not just the gateway.<\/li><li>We tested NetScaler CPX. VPX and MPX share the SSL configuration model, but test on your own appliance first.<\/li><li><strong>This is not a security patch.<\/strong> It takes you out of the opportunistic first wave. It does nothing against a targeted attacker who knows (or has looked up) your hostname.<\/li><li><strong>DTLS (UDP\/443) is not covered.<\/strong> We tested TLS over TCP only. CVE-2026-88772 is exploited via DTLS, which is enabled by default on gateway vservers [10], and whether SNI enforcement applies to DTLS handshakes is untested. Check it yourself or disable DTLS if you don&#8217;t need it. The hardening still helps: mass scanners mostly identify NetScaler appliances via HTTPS on TCP\/443 before they fire the exploit.<\/li><li><strong>Other listeners on the same IP address can still leak the hostname.<\/strong> A port-80 vserver that redirects to https:\/\/gateway.example.com\/ hands out the name in its Location Other SSL vservers with a default certificate on the same IP address, or a management interface reachable from the Internet, do the same. Check every listener on that IP address, not just the gateway.<\/li><\/ul><h2>Verifying it with SNItch and Censys<\/h2><p><a href=\"https:\/\/github.com\/cirosec\/SNItch\" target=\"_blank\" rel=\"noopener\">SNItch<\/a> [7] is our open-source tool for SNI-based host discovery and testing. It runs a fresh TLS handshake per candidate hostname, tries empty, wrong and IP-literal SNI values and reports how the server responds. That makes it a good way to check how well your NetScaler hides from attackers who don&#8217;t know its hostname.<\/p><pre>git clone https:\/\/github.com\/cirosec\/SNItch.git<br \/>cd SNItch<br \/>go build -o SNItch .<\/pre><p><strong>Check 1: the mass scanner&#8217;s view.<\/strong> Scan only the NetScaler&#8217;s IP address:<\/p><pre>SNItch -t X.X.X.X:443<\/pre><p>On a default NetScaler, the (EMPTY SNI) probe returns a certificate, and SNItch reads your gateway&#8217;s hostname straight from it (see Figure 1). On a hardened one, the empty-SNI and IP-as-SNI probes get nothing back: no certificate, no hostname. If SNItch still finds the hostname, it leaked through another channel, such as a PTR record, CT logs or a redirect (see the next section).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f0cdf37 elementor-widget elementor-widget-menu-anchor\" data-id=\"2f0cdf37\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"section3\"><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2eebf207 elementor-widget elementor-widget-image\" data-id=\"2eebf207\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_censored.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"SNItch_good_censored\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6Mjk1MjEsInVybCI6Imh0dHBzOlwvXC9jaXJvc2VjLmRlXC93cC1jb250ZW50XC91cGxvYWRzXC8yMDI2XC8xMFwvU05JdGNoX2dvb2RfY2Vuc29yZWQucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"268\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium_large size-medium_large wp-image-29521 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_censored-768x321.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_censored-768x321.png 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_censored-300x125.png 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_censored.png 941w\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Figure 2: Properly hardened NetScaler instance that does not reveal its hostname when scanned with SNItch.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f4e37a9 elementor-widget elementor-widget-text-editor\" data-id=\"2f4e37a9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>If you search for the same IP on Censys you get the following empty result on the properly hardened NetScaler system (note the .102 IP-Address again):<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-765ca960 elementor-widget elementor-widget-image\" data-id=\"765ca960\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Censys_good_censored\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6Mjk1MTcsInVybCI6Imh0dHBzOlwvXC9jaXJvc2VjLmRlXC93cC1jb250ZW50XC91cGxvYWRzXC8yMDI2XC8xMFwvQ2Vuc3lzX2dvb2RfY2Vuc29yZWQucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"205\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium_large size-medium_large wp-image-29517 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored-768x246.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored-768x246.png 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored-300x96.png 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored-1024x328.png 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored-1536x493.png 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/Censys_good_censored.png 1637w\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Figure 3: Properly hardened NetScaler on Censys.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-204818cf elementor-widget elementor-widget-text-editor\" data-id=\"204818cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Check 2: legitimate users still get in.<\/strong> Supply the real hostname as a positive control:<\/p><pre>SNItch gateway.example.com --no-recon<\/pre><p>The hostname should show a valid certificate and an HTTP status, typically 200, or a redirect to the login page. If it doesn&#8217;t, recheck the SNI certificate binding.<\/p><p>Scanning the same IP address using the hostname reveals the NetScaler, so the hardening works (see the .102 IP address as above) and users can use it as usual:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-133ec339 elementor-widget elementor-widget-image\" data-id=\"133ec339\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"SNItch_good_wdomain_censored\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6Mjk1MjMsInVybCI6Imh0dHBzOlwvXC9jaXJvc2VjLmRlXC93cC1jb250ZW50XC91cGxvYWRzXC8yMDI2XC8xMFwvU05JdGNoX2dvb2Rfd2RvbWFpbl9jZW5zb3JlZC5wbmcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"276\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium_large size-medium_large wp-image-29523 lazyload\" alt=\"\" sizes=\"(max-width: 640px) 100vw, 640px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored-768x331.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored-768x331.png 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored-300x129.png 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored-1024x441.png 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2026\/10\/SNItch_good_wdomain_censored.png 1095w\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Figure 4: Using the hostname as entry point for SNItch reveals the NetScaler again<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2641e0e8 elementor-widget elementor-widget-text-editor\" data-id=\"2641e0e8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Your hostname is probably already public<\/h2><p>SNI enforcement only helps while the attacker doesn&#8217;t know the hostname, and most gateway hostnames are far from secret. Every publicly trusted certificate is registered in the Certificate Transparency (CT) logs, which anyone can search, for example on <a href=\"https:\/\/crt.sh\" target=\"_blank\" rel=\"noopener\">crt.sh<\/a> or, if crt.sh is down, on the subdomain index <a href=\"https:\/\/crt.name\" target=\"_blank\" rel=\"noopener\">crt.name<\/a>. A query on crt.sh for %.example.com returns citrix.example.com, vpn.example.com and gateway.example.com. Finding the one that resolves to a NetScaler requires a short script.<\/p><p>An attacker willing to invest a little more effort can build a target list from CT logs instead of scanning IP addresses. We did not see this in the September wave, but it is the obvious next step once SNI enforcement becomes common.<\/p><p>The countermeasure: keep the gateway&#8217;s hostname out of CT logs.<\/p><ol><li><strong>Use a new, non-obvious hostname.<\/strong> Not , vpn., remote. or gateway., but something like gateway-k7q2.example.com. A short random suffix is enough: the bare word is on every wordlist, while the suffixed name is not. Users usually rely on bookmarks or direct links in their browser history and rarely type it out once visited.<\/li><li><strong>Use a wildcard certificate<\/strong> (*.example.com). CT then shows only the wildcard, not the hostname. Ideally, use a dedicated wildcard on a subdomain (e.g. *.r.example.com) that is located only on the NetScaler, so a compromised appliance doesn&#8217;t leak a key used elsewhere.<\/li><li><strong>Step 2 becomes mandatory.<\/strong> With a wildcard certificate, Step 1&#8217;s SNI-only binding accepts <em>any<\/em> matching subdomain. Only the exact-match ClientHello policy restricts access to the real hostname.<\/li><li><strong>Retire the old name.<\/strong> As long as example.com points to the same IP address with its old certificate, nothing is gained.<\/li><\/ol><p>One risk remains: the hostname is still in public DNS, and passive DNS databases may pick it up over time. This raises the bar; it does not hide the gateway from a determined, targeted attacker. If the zone is signed with DNSSEC using NSEC instead of NSEC3, the hostname could also be found by walking the zone.<\/p><p><strong>Setting up a new NetScaler?<\/strong> Then start with the stealthiest setup:<\/p><ul><li><strong>A dedicated zone:<\/strong> a subdomain of your main domain, e.g. *.gateway.example.com, or a new domain with no link to your company.<\/li><li><strong>A wildcard certificate<\/strong> for that zone (*.gateway.example.com), so CT logs never show the real hostname.<\/li><li><strong>No A record on the zone itself.<\/strong> Only a hard-to-guess hostname, e.g. workplace-gateway-8b4e.gateway.example.com, resolves to the NetScaler.<\/li><li><strong>The ClientHello policy matches only that exact hostname.<\/strong> Everything else gets a TCP reset.<\/li><\/ul><p>With this setup, bots, mass scanners and opportunistic attackers have very little to go on: no IP response, no hostname in CT logs, nothing to guess from the domain.<\/p><h2>Conclusion<\/h2><p>The 2026 NetScaler zero-days were exploited for weeks before a patch existed. In our cases, the first wave didn&#8217;t need to know its victims. It sprayed IP addresses. A NetScaler that only answers to its hostname was never on that list.<\/p><p>We think that the main takeaway is how cheap this protection is: about ten lines for the SNI part and a one-off change, to significantly reduce the attack surface of a NetScaler:<\/p><ol><li>Use SSL profile mode, enable SNI in a custom front-end profile and bind certificates only with -SNICert.<\/li><li>Optionally, add the ClientHello reset policy (-type CLIENTHELLO_REQ, case-insensitive). With a wildcard certificate, it becomes mandatory.<\/li><li>Verify with SNItch that an IP-address-only scan finds nothing.<\/li><li>Move the gateway to a new, non-obvious hostname behind a wildcard certificate, so CT logs do not give it away.<\/li><\/ol><p>It won&#8217;t stop a targeted attacker, and it doesn&#8217;t replace patching. But it can buy you the days between &#8220;exploited in the wild&#8221; and &#8220;patch available&#8221;.<\/p><h2>References<\/h2><ol><li>BleepingComputer: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days\/\" target=\"_blank\" rel=\"noopener\">Citrix confirms two NetScaler RCE zero-days exploited in attacks<\/a><\/li><li>SecurityWeek: <a href=\"https:\/\/www.securityweek.com\/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier\/\" target=\"_blank\" rel=\"noopener\">Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier<\/a><\/li><li>Rapid7: <a href=\"https:\/\/www.rapid7.com\/blog\/post\/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\/\" target=\"_blank\" rel=\"noopener\">Zero-Day Exploitation of Citrix NetScaler ADC and Gateway<\/a><\/li><li>GreyNoise: <a href=\"https:\/\/www.greynoise.io\/blog\/swarming-against-citrix-0-day-exploitation\" target=\"_blank\" rel=\"noopener\">Swarming Against Citrix 0-Day Exploitation<\/a><\/li><li>CrowdSec: <a href=\"https:\/\/www.crowdsec.net\/vulntracking-report\/cve-2026-88771-citrix-netscaler-pre-auth-command-injection\" target=\"_blank\" rel=\"noopener\">CVE-2026-88771: Citrix NetScaler Command Injection<\/a>; timeline incl. eSentire: <a href=\"https:\/\/www.esentire.com\/security-advisories\/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772\" target=\"_blank\" rel=\"noopener\">Ongoing Exploitation of Citrix NetScaler ADC and NetScaler Gateway Vulnerabilities<\/a>; GTIG and Mandiant findings: <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances?hl=en\" target=\"_blank\" rel=\"noopener\">Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances<\/a><\/li><li>Johannes Norz: <a href=\"https:\/\/norz.at\/?p=2419\" target=\"_blank\" rel=\"noopener\">Blocking requests to the IP address in SSL vServers on Citrix NetScaler ADC<\/a><\/li><li>cirosec: <a href=\"https:\/\/github.com\/cirosec\/SNItch\" target=\"_blank\" rel=\"noopener\">SNItch on GitHub<\/a> and <a href=\"https:\/\/cirosec.de\/en\/news\/fuzzing-vhosts-with-snitch\/\" target=\"_blank\" rel=\"noopener\">Fuzzing vhosts with SNItch<\/a><\/li><li>Citrix Tech Zone: <a href=\"https:\/\/community.citrix.com\/tech-zone\/build\/tech-papers\/networking-tls-best-practices-2026\/\" target=\"_blank\" rel=\"noopener\">Networking SSL\/TLS Best Practices (Q3 2026 Edition)<\/a><\/li><li>watchTowr Labs: <a href=\"https:\/\/labs.watchtowr.com\/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771\/\" target=\"_blank\" rel=\"noopener\">Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)<\/a><\/li><li>watchTowr Labs: <a href=\"https:\/\/labs.watchtowr.com\/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772\/\" target=\"_blank\" rel=\"noopener\">Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)<\/a><\/li><li>NetScaler security bulletin: <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697096\" target=\"_blank\" rel=\"noopener\">CTX697096 (CVE-2026-88771 to CVE-2026-88778)<\/a><\/li><li>NetScaler security bulletin: <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697174\" target=\"_blank\" rel=\"noopener\">CTX697174 (CVE-2026-88779)<\/a><\/li><li>MITRE CVE records: <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88771\" target=\"_blank\" rel=\"noopener\">CVE-2026-88771<\/a>, <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88772\" target=\"_blank\" rel=\"noopener\">CVE-2026-88772<\/a>, <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-88779\" target=\"_blank\" rel=\"noopener\">CVE-2026-88779<\/a><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-713db5ee\" data-id=\"713db5ee\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6dd610f4 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6dd610f4\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-1104de8\" data-id=\"1104de8\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-122ac63c elementor-widget__width-initial elementor-widget elementor-widget-heading\" data-id=\"122ac63c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Further blog articles<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-40609bb3\" data-id=\"40609bb3\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-33a32340 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"33a32340\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5c513d52\" data-id=\"5c513d52\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-68334cc0 elementor-grid-3 elementor-grid-tablet-2 elementor-grid-mobile-1 elementor-posts--thumbnail-top elementor-card-shadow-yes elementor-posts__hover-gradient load-more-align-center elementor-widget elementor-widget-posts\" data-id=\"68334cc0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;pagination_type&quot;:&quot;load_more_on_click&quot;,&quot;cards_columns&quot;:&quot;3&quot;,&quot;cards_columns_tablet&quot;:&quot;2&quot;,&quot;cards_columns_mobile&quot;:&quot;1&quot;,&quot;cards_row_gap&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:35,&quot;sizes&quot;:[]},&quot;cards_row_gap_tablet_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;cards_row_gap_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;cards_row_gap_mobile_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;cards_row_gap_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;load_more_spinner&quot;:{&quot;value&quot;:&quot;fas fa-spinner&quot;,&quot;library&quot;:&quot;fa-solid&quot;}}\" data-widget_type=\"posts.cards\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-posts-container elementor-posts elementor-posts--skin-cards elementor-grid\" role=\"list\">\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-29524 post type-post status-publish format-standard has-post-thumbnail hentry category-incident-response category-pentesting\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"169\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18538 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-300x169.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-300x169.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-1024x576.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-768x432.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-1536x864.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-2048x1152.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Incident Response<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/\" >\n\t\t\t\tHiding your NetScaler from mass exploitation with SNI\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>October 27, 2026 &#8211; A default NetScaler answers anyone who connects to its IP and reveals its hostname in the certificate. During the CVE-2026-88771\/-88772 zero-day wave, that made it an easy target for IP-based mass scans. Our new blog post shows how to enforce SNI in a few lines of config, so the next wave passes you by and you gain time until a patch arrives.<\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/\" aria-label=\"Read more about Hiding your NetScaler from mass exploitation with SNI\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-26550 post type-post status-publish format-standard has-post-thumbnail hentry category-pentesting tag-pentesting\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/fuzzing-vhosts-with-snitch\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18530 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/luca-bravo-XJXWbfSo2f0-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Pentesting<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/fuzzing-vhosts-with-snitch\/\" >\n\t\t\t\tFuzzing vhosts with SNI(tch)\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>June 10, 2026 &#8211; Host header fuzzing stops at the HTTP layer and can&#8217;t find services hardened at the TLS handshake via SNI validation. SNItch fills that gap by fuzzing the SNI field directly &#8211; and doubles as a tool to verify your own servers don&#8217;t leak hostnames to IP-based reconnaissance.<br \/>\n<br \/>\nAuthor: Felix Friedberger <\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/fuzzing-vhosts-with-snitch\/\" aria-label=\"Read more about Fuzzing vhosts with SNI(tch)\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-27015 post type-post status-publish format-standard has-post-thumbnail hentry category-pentesting category-red-teaming-en tag-redteaming\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/reifegrad-fur-sicherheitsuberprufungen\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18542 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Pentesting<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/reifegrad-fur-sicherheitsuberprufungen\/\" >\n\t\t\t\tReife\u00adgrad f\u00fcr Sicherheits\u00ad\u00fcber\u00adpr\u00fcfungen\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>11. Mai 2026 &#8211; Eine kurze Zusammenfassung unseres Vortrags bei den cirosec-TrendTagen zu Pentesting, Assumed Breach, Red Teaming, TLPT &#038; Co.<br \/>\n<br \/>\nAuthor: Michael Br\u00fcgge<\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/reifegrad-fur-sicherheitsuberprufungen\/\" aria-label=\"Read more about Reife\u00adgrad f\u00fcr Sicherheits\u00ad\u00fcber\u00adpr\u00fcfungen\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-26438 post type-post status-publish format-standard has-post-thumbnail hentry category-pentesting tag-pentesting\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/penetration-testing-llm-web-apps-common-pitfalls\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18542 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/towfiqu-barbhuiya-em5w9_xj3uU-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Pentesting<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/penetration-testing-llm-web-apps-common-pitfalls\/\" >\n\t\t\t\tPenet\u00adration Test\u00ading LLM Web Apps: Com\u00admon Pit\u00adfalls\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>April 14, 2026 &#8211; This article focuses exclusively on penetration testing applications that use off-the-shelf LLM models through inference APIs.<br \/>\n<br \/>\nAuthor: Felix Friedberger <\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/penetration-testing-llm-web-apps-common-pitfalls\/\" aria-label=\"Read more about Penet\u00adration Test\u00ading LLM Web Apps: Com\u00admon Pit\u00adfalls\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-24785 post type-post status-publish format-standard has-post-thumbnail hentry category-forensic category-incident-response tag-forensik\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/a-collection-of-shai-hulud-2-0-iocs\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18528 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/krzysztof-hepner-C1JTOq_uTpY-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Forensic<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/a-collection-of-shai-hulud-2-0-iocs\/\" >\n\t\t\t\tA collection of Shai-Hulud 2.0 IoCs\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>November 26, 2025 &#8211; Regarding the Node Package Manager (npm) supply chain attack that started November 21, 2025, and affected thousands of packages, we have collected and identified corresponding hashes to make them publicly available in one single place for easier access.<br \/>\n<br \/>\nAuthor: Niklas V\u00f6mel, Felix Friedberger<\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/a-collection-of-shai-hulud-2-0-iocs\/\" aria-label=\"Read more about A collection of Shai-Hulud 2.0 IoCs\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-23940 post type-post status-publish format-standard has-post-thumbnail hentry category-forensic category-incident-response tag-forensik\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/iocs_cryto_stealer_supply_chain_incident\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18534 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shahadat-rahman-BfrQnKBulYQ-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Forensic<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/iocs_cryto_stealer_supply_chain_incident\/\" >\n\t\t\t\tIOCs of the npm crypto stealer supply chain incident\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>September 25, 2025 &#8211; Regarding the Node Package Manager (npm) supply chain attack that started September 8, 2025, and affected 27 packages, we have collected and identified corresponding hashes to make them publicly available in one single place for easier access.<br \/>\n<br \/>\nAuthor: Niklas V\u00f6mel<\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/iocs_cryto_stealer_supply_chain_incident\/\" aria-label=\"Read more about IOCs of the npm crypto stealer supply chain incident\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-21582 post type-post status-publish format-standard has-post-thumbnail hentry category-pentesting category-red-teaming tag-dora tag-threat-led-penetration-testing tag-tlpt tag-tlpt-pentesting\" role=\"listitem\">\n\t\t\t<div class=\"elementor-post__card\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/cirosec.de\/en\/news\/tlpt-bedrohungsorientierte-penetrationstests-nach-dora\/\" tabindex=\"-1\" ><div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"200\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-medium size-medium wp-image-18532 lazyload\" alt=\"\" sizes=\"(max-width: 300px) 100vw, 300px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-300x200.jpg\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-300x200.jpg 300w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-1024x683.jpg 1024w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-768x512.jpg 768w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-1536x1024.jpg 1536w, https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/philipp-katzenberger-iIJrUoeRoCQ-unsplash-2048x1365.jpg 2048w\"><\/div><\/a>\n\t\t\t\t<div class=\"elementor-post__badge\">Pentesting<\/div>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/cirosec.de\/en\/news\/tlpt-bedrohungsorientierte-penetrationstests-nach-dora\/\" >\n\t\t\t\tTLPT: Bedroh\u00adungs\u00ad\u00ad\u00adorientierte Penetra\u00adtions\u00adtests nach DORA\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<div class=\"elementor-post__excerpt\">\n\t\t\t<p>January 24, 2025 &#8211; Since January 17, 2025, the Digital Operational Resilience Act (DORA) has been put into practice. One important aspect of DORA is the requirement of regularly performing threat-led penetration tests (TLPT). Only selected entities within the financial sector are required to conduct TLPTs. Even though TLPTs sound like a new concept, they have actually existed in Germany since 2020 in form of TIBER tests. This blog post describes the concepts behind TLPTs and how they are conducted. Furthermore, alternatives for targeted and budget-oriented red team assessments are given.<br \/>\n<br \/>\nAuthor: Michael Br\u00fcgge<\/p>\n\t\t<\/div>\n\t\t\n\t\t<a class=\"elementor-post__read-more\" href=\"https:\/\/cirosec.de\/en\/news\/tlpt-bedrohungsorientierte-penetrationstests-nach-dora\/\" aria-label=\"Read more about TLPT: Bedroh\u00adungs\u00ad\u00ad\u00adorientierte Penetra\u00adtions\u00adtests nach DORA\" tabindex=\"-1\" >\n\t\t\tMehr Infos \u00bb\t\t<\/a>\n\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<\/div>\n\t\t\t\t\t<span class=\"e-load-more-spinner\">\n\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-spinner\"><\/i>\t\t\t<\/span>\n\t\t\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-32f86fcb e-con-full e-flex e-con e-parent\" data-id=\"32f86fcb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3d73c8ab elementor-widget elementor-widget-template\" data-id=\"3d73c8ab\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<div data-elementor-type=\"section\" data-elementor-id=\"6023\" class=\"elementor elementor-6023 elementor-2968 elementor-2968\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3920b242 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3920b242\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-61cde52c\" data-id=\"61cde52c\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7eba007 elementor-widget elementor-widget-spacer\" data-id=\"7eba007\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7346d88 elementor-widget elementor-widget-heading\" data-id=\"7346d88\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Do you want to protect your systems? Feel free to get in touch with us.<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b0432b elementor-widget elementor-widget-spacer\" data-id=\"1b0432b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-5cdf3c58 elementor-section-content-middle elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5cdf3c58\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-40c99187\" data-id=\"40c99187\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4a1d7b6a elementor-align-right elementor-widget elementor-widget-button\" data-id=\"4a1d7b6a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/cirosec.de\/en\/inquiry\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Send Enquiry<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-3b9d9ea6\" data-id=\"3b9d9ea6\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7e7c4d9b elementor-widget elementor-widget-button\" data-id=\"7e7c4d9b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/cirosec.de\/en\/contact-us\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Contact Details<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-53dab1bb elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"53dab1bb\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6359f84d\" data-id=\"6359f84d\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2229dbec elementor-widget elementor-widget-template\" data-id=\"2229dbec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<footer data-elementor-type=\"footer\" data-elementor-id=\"6025\" class=\"elementor elementor-6025 elementor-945 elementor-945\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1e44cc2 elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"1e44cc2\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e9b41ce\" data-id=\"e9b41ce\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-51c0c74 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"51c0c74\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-inner-column elementor-element elementor-element-8ac5cc6\" data-id=\"8ac5cc6\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-af371ae elementor-widget elementor-widget-theme-site-logo elementor-widget-image\" data-id=\"af371ae\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-site-logo.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/cirosec.de\/en\/\">\n\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"626\" height=\"188\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"attachment-full size-full wp-image-5868 lazyload\" alt=\"\" sizes=\"(max-width: 626px) 100vw, 626px\" data-src=\"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png\" data-srcset=\"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png 626w, https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent-300x90.png 300w\">\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-85f2a11 elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"85f2a11\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Competent IT security consulting, pentests, incident response and training<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5731ee0 elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"5731ee0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>cirosec GmbH<br \/>Ferdinand-Braun-Stra\u00dfe 4<br \/>74074 Heilbronn, Germany<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-inner-column elementor-element elementor-element-c7c447f\" data-id=\"c7c447f\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4826023 elementor-widget elementor-widget-heading\" data-id=\"4826023\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">Quicklinks<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f26d479 elementor-nav-menu__align-start elementor-nav-menu--dropdown-none elementor-widget elementor-widget-nav-menu\" data-id=\"f26d479\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;layout&quot;:&quot;vertical&quot;,&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-caret-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;}}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-vertical e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-f26d479\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9132\"><a href=\"https:\/\/cirosec.de\/en\/about-us\/\" class=\"elementor-item\">About us<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9133\"><a href=\"https:\/\/cirosec.de\/en\/services\/\" class=\"elementor-item\">Services<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9134\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/\" class=\"elementor-item\">Trainings<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9139\"><a href=\"https:\/\/cirosec.de\/en\/secure-email-communication-with-cirosec\/\" class=\"elementor-item\">Secure Email Communication with cirosec<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-f26d479\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9132\"><a href=\"https:\/\/cirosec.de\/en\/about-us\/\" class=\"elementor-item\" tabindex=\"-1\">About us<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9133\"><a href=\"https:\/\/cirosec.de\/en\/services\/\" class=\"elementor-item\" tabindex=\"-1\">Services<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9134\"><a href=\"https:\/\/cirosec.de\/en\/trainings\/\" class=\"elementor-item\" tabindex=\"-1\">Trainings<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9139\"><a href=\"https:\/\/cirosec.de\/en\/secure-email-communication-with-cirosec\/\" class=\"elementor-item\" tabindex=\"-1\">Secure Email Communication with cirosec<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-inner-column elementor-element elementor-element-29e8304\" data-id=\"29e8304\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-14232af elementor-widget elementor-widget-heading\" data-id=\"14232af\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">Social Media<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c23ea92 elementor-nav-menu__align-start elementor-nav-menu--dropdown-none elementor-widget elementor-widget-nav-menu\" data-id=\"c23ea92\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;layout&quot;:&quot;vertical&quot;,&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-caret-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;}}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-vertical e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-c23ea92\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-13039\"><a target=\"_blank\" href=\"https:\/\/www.instagram.com\/cirosecgmbh\" class=\"elementor-item\">Instagram<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9136\"><a target=\"_blank\" href=\"https:\/\/www.xing.com\/pages\/cirosecgmbh\" class=\"elementor-item\">Xing<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9137\"><a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/company\/cirosec-gmbh\/\" class=\"elementor-item\">LinkedIn<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9138\"><a target=\"_blank\" href=\"https:\/\/twitter.com\/cirosec\" class=\"elementor-item\">X (Twitter)<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-21563\"><a href=\"https:\/\/infosec.exchange\/@cirosec\" class=\"elementor-item\">Mastodon<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-c23ea92\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-13039\"><a target=\"_blank\" href=\"https:\/\/www.instagram.com\/cirosecgmbh\" class=\"elementor-item\" tabindex=\"-1\">Instagram<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9136\"><a target=\"_blank\" href=\"https:\/\/www.xing.com\/pages\/cirosecgmbh\" class=\"elementor-item\" tabindex=\"-1\">Xing<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9137\"><a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/company\/cirosec-gmbh\/\" class=\"elementor-item\" tabindex=\"-1\">LinkedIn<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-9138\"><a target=\"_blank\" href=\"https:\/\/twitter.com\/cirosec\" class=\"elementor-item\" tabindex=\"-1\">X (Twitter)<\/a><\/li>\n<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-21563\"><a href=\"https:\/\/infosec.exchange\/@cirosec\" class=\"elementor-item\" tabindex=\"-1\">Mastodon<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-inner-column elementor-element elementor-element-871a164\" data-id=\"871a164\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a46aa52 elementor-widget elementor-widget-heading\" data-id=\"a46aa52\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">Legal<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-50e6031 elementor-nav-menu__align-start elementor-nav-menu--dropdown-none elementor-widget elementor-widget-nav-menu\" data-id=\"50e6031\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;layout&quot;:&quot;vertical&quot;,&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-caret-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;}}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-vertical e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-50e6031\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9146\"><a href=\"https:\/\/cirosec.de\/en\/imprint\/\" class=\"elementor-item\">Imprint<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9147\"><a href=\"https:\/\/cirosec.de\/en\/privacy-policy\/\" class=\"elementor-item\">Privacy Policy<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9148\"><a href=\"https:\/\/cirosec.de\/en\/cirosec-responsible-disclosure-policy\/\" class=\"elementor-item\">cirosec Responsible Disclosure Policy<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-50e6031\" class=\"elementor-nav-menu sm-vertical\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9146\"><a href=\"https:\/\/cirosec.de\/en\/imprint\/\" class=\"elementor-item\" tabindex=\"-1\">Imprint<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9147\"><a href=\"https:\/\/cirosec.de\/en\/privacy-policy\/\" class=\"elementor-item\" tabindex=\"-1\">Privacy Policy<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-9148\"><a href=\"https:\/\/cirosec.de\/en\/cirosec-responsible-disclosure-policy\/\" class=\"elementor-item\" tabindex=\"-1\">cirosec Responsible Disclosure Policy<\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/footer>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>October 27, 2026 &#8211; A default NetScaler answers anyone who connects to its IP and reveals its hostname in the certificate. During the CVE-2026-88771\/-88772 zero-day wave, that made it an easy target for IP-based mass scans. Our new blog post shows how to enforce SNI in a few lines of config, so the next wave passes you by and you gain time until a patch arrives.<\/p>\n","protected":false},"author":59,"featured_media":18538,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_canvas","format":"standard","meta":{"footnotes":""},"categories":[63,75],"tags":[],"class_list":["post-29524","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response","category-pentesting"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hiding your NetScaler from mass exploitation with SNI - cirosec<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hiding your NetScaler from mass exploitation with SNI - cirosec\" \/>\n<meta property=\"og:description\" content=\"October 27, 2026 - A default NetScaler answers anyone who connects to its IP and reveals its hostname in the certificate. During the CVE-2026-88771\/-88772 zero-day wave, that made it an easy target for IP-based mass scans. Our new blog post shows how to enforce SNI in a few lines of config, so the next wave passes you by and you gain time until a patch arrives.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/\" \/>\n<meta property=\"og:site_name\" content=\"cirosec\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T09:55:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-27T12:09:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1440\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Felix Friedberger\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Felix Friedberger\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/\"},\"author\":{\"name\":\"Felix Friedberger\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#\\\/schema\\\/person\\\/751eba0a8287d59b10ce9f074ea2e713\"},\"headline\":\"Hiding your NetScaler from mass exploitation with SNI\",\"datePublished\":\"2026-10-27T09:55:48+00:00\",\"dateModified\":\"2026-10-27T12:09:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/\"},\"wordCount\":2875,\"publisher\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg\",\"articleSection\":[\"Incident Response\",\"Pentesting\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/\",\"url\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/\",\"name\":\"Hiding your NetScaler from mass exploitation with SNI - cirosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg\",\"datePublished\":\"2026-10-27T09:55:48+00:00\",\"dateModified\":\"2026-10-27T12:09:29+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg\",\"width\":2560,\"height\":1440},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/hiding-your-netscaler-from-mass-exploitation-with-sni\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/cirosec.de\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hiding your NetScaler from mass exploitation with SNI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/cirosec.de\\\/en\\\/\",\"name\":\"cirosec\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cirosec.de\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#organization\",\"name\":\"cirosec\",\"url\":\"https:\\\/\\\/cirosec.de\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/Logo_Cirosec_rgb_53x16mm-transparent.png\",\"contentUrl\":\"https:\\\/\\\/cirosec.de\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/Logo_Cirosec_rgb_53x16mm-transparent.png\",\"width\":626,\"height\":188,\"caption\":\"cirosec\"},\"image\":{\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cirosec.de\\\/en\\\/#\\\/schema\\\/person\\\/751eba0a8287d59b10ce9f074ea2e713\",\"name\":\"Felix Friedberger\",\"url\":\"https:\\\/\\\/cirosec.de\\\/en\\\/news\\\/author\\\/felix-friedberger\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hiding your NetScaler from mass exploitation with SNI - cirosec","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/","og_locale":"en_US","og_type":"article","og_title":"Hiding your NetScaler from mass exploitation with SNI - cirosec","og_description":"October 27, 2026 - A default NetScaler answers anyone who connects to its IP and reveals its hostname in the certificate. During the CVE-2026-88771\/-88772 zero-day wave, that made it an easy target for IP-based mass scans. Our new blog post shows how to enforce SNI in a few lines of config, so the next wave passes you by and you gain time until a patch arrives.","og_url":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/","og_site_name":"cirosec","article_published_time":"2026-10-27T09:55:48+00:00","article_modified_time":"2026-10-27T12:09:29+00:00","og_image":[{"width":2560,"height":1440,"url":"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg","type":"image\/jpeg"}],"author":"Felix Friedberger","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Felix Friedberger","Est. reading time":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#article","isPartOf":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/"},"author":{"name":"Felix Friedberger","@id":"https:\/\/cirosec.de\/en\/#\/schema\/person\/751eba0a8287d59b10ce9f074ea2e713"},"headline":"Hiding your NetScaler from mass exploitation with SNI","datePublished":"2026-10-27T09:55:48+00:00","dateModified":"2026-10-27T12:09:29+00:00","mainEntityOfPage":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/"},"wordCount":2875,"publisher":{"@id":"https:\/\/cirosec.de\/en\/#organization"},"image":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#primaryimage"},"thumbnailUrl":"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg","articleSection":["Incident Response","Pentesting"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/","url":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/","name":"Hiding your NetScaler from mass exploitation with SNI - cirosec","isPartOf":{"@id":"https:\/\/cirosec.de\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#primaryimage"},"image":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#primaryimage"},"thumbnailUrl":"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg","datePublished":"2026-10-27T09:55:48+00:00","dateModified":"2026-10-27T12:09:29+00:00","breadcrumb":{"@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#primaryimage","url":"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg","contentUrl":"https:\/\/cirosec.de\/wp-content\/uploads\/2024\/07\/shubham-dhage-v0VjjYYFjOg-unsplash-scaled.jpg","width":2560,"height":1440},{"@type":"BreadcrumbList","@id":"https:\/\/cirosec.de\/en\/news\/hiding-your-netscaler-from-mass-exploitation-with-sni\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/cirosec.de\/en\/"},{"@type":"ListItem","position":2,"name":"Hiding your NetScaler from mass exploitation with SNI"}]},{"@type":"WebSite","@id":"https:\/\/cirosec.de\/en\/#website","url":"https:\/\/cirosec.de\/en\/","name":"cirosec","description":"","publisher":{"@id":"https:\/\/cirosec.de\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cirosec.de\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cirosec.de\/en\/#organization","name":"cirosec","url":"https:\/\/cirosec.de\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cirosec.de\/en\/#\/schema\/logo\/image\/","url":"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png","contentUrl":"https:\/\/cirosec.de\/wp-content\/uploads\/2023\/08\/Logo_Cirosec_rgb_53x16mm-transparent.png","width":626,"height":188,"caption":"cirosec"},"image":{"@id":"https:\/\/cirosec.de\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/cirosec.de\/en\/#\/schema\/person\/751eba0a8287d59b10ce9f074ea2e713","name":"Felix Friedberger","url":"https:\/\/cirosec.de\/en\/news\/author\/felix-friedberger\/"}]}},"_links":{"self":[{"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/posts\/29524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/users\/59"}],"replies":[{"embeddable":true,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/comments?post=29524"}],"version-history":[{"count":32,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/posts\/29524\/revisions"}],"predecessor-version":[{"id":29563,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/posts\/29524\/revisions\/29563"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/media\/18538"}],"wp:attachment":[{"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/media?parent=29524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/categories?post=29524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cirosec.de\/en\/wp-json\/wp\/v2\/tags?post=29524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}