Late September, Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, both scoring 9.5 on CVSS. One let an unauthenticated attacker run arbitrary commands on a default configuration, no special setup required. The other bypassed authentication and handed attackers root access. Both were exploited as zero-days, before any patch existed, and tens of thousands of internet-facing appliances were exposed when the fixes shipped. CISA gave federal agencies three days to remediate.

By now the incident has scrolled past. Patches are out, most organizations have applied them, and it reads like last month’s news. That’s exactly why it’s worth a second look, because the interesting failure was never the vulnerability itself.

Vulnerabilities Are Inevitable. Slow Response Is a Choice.

Nobody expects a security team to prevent a zero-day. That’s not the standard anyone is holding organizations to, and it shouldn’t be. What separates organizations that weathered this cleanly from the ones that ended up in an incident report is how fast they moved once the exploit was public and a fix existed.

That speed is rarely a technical constraint. It’s a governance one. Does the organization know its full inventory of internet-facing appliances without having to ask five different teams? Is there a documented, pre-approved process for emergency patching that doesn’t require a change advisory board to convene on its normal two-week cycle? Does someone own the vendor’s security bulletins, so a critical disclosure doesn’t sit unread in an inbox for two days?

Organizations with mature governance answered those questions in hours. Organizations without it were still figuring out who owned the appliance three days later, while attackers were already inside.

The Board Question That Actually Matters

If this incident came up in your board reporting at all, the framing was probably operational: are we patched, are we affected, what’s our exposure. Those are the right first questions, but they’re not the governance question.

The governance question is whether your organization has a demonstrated, repeatable capability to respond to a critical, actively exploited vulnerability within a defined window, regardless of which vendor or product gets hit next. That’s a program maturity question, not an incident-specific one.

An organization that can say “here’s our emergency patch SLA, here’s how fast we actually moved, here’s the gap between target and actual” is demonstrating governance. An organization that can only say “we got lucky, we weren’t running the vulnerable configuration” learned nothing that will help with the next one.

What to Do With This

Pull your internal timeline on this incident. When did the disclosure reach someone who could act on it, when was the emergency process invoked, and when was remediation confirmed complete? Compare that against whatever SLA you think you have, even an informal one.

If the timeline is longer than it should have been, the fix usually isn’t a new tool. It’s naming an owner for vendor bulletin monitoring, pre-authorizing an emergency change process, and keeping a current inventory of internet-facing infrastructure that nobody has to hunt for during a live incident.

The next critical zero-day is a when, not an if. The organizations that handle it well will be the ones that treated this one as a rehearsal.

---

Discussion Questions

1. Do you know how long it took your organization to go from NetScaler disclosure to confirmed remediation? Is that faster or slower than your target for critical, actively exploited vulnerabilities?
2. Does your organization have a documented, pre-approved emergency patching process that bypasses the normal change cadence, or is every critical vulnerability an ad hoc decision?
3. Is vendor security bulletin monitoring explicitly owned by someone, with a defined escalation path?

---

Cody Keller is an Information Security Manager specializing in Governance, Risk, and Compliance with over ten years of experience in cybersecurity strategy, risk management, and regulatory compliance. He holds the CISSP, CISM, and CRISC certifications and is the author of The Parent’s Guide to Online Safety. Through CKCybersecurity.com, he writes and consults on practical security program management for organizations navigating an increasingly complex threat and regulatory landscape. Connect on LinkedIn at linkedin.com/in/codyjkeller or reach out at ckcyberconsulting@gmail.com.