Recent investigations by LevelBlue's Threat Hunt Operations & Research team revealed that attackers are exploiting a serious pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. These vulnerabilities allow malicious actors to drop web shells into the systems, which can facilitate unauthorized access and theft of sensitive configuration data. The exploitation has been observed across multiple customer environments, raising concerns for organizations using these Citrix products. This incident emphasizes the need for companies to ensure their systems are updated and secure against such vulnerabilities, as attackers are actively trying to exploit these weaknesses to gain higher privileges and control over affected systems.