Photo by Scott Rodgerson on Unsplash
Security researchers recently confirmed something that keeps network defenders up at night: two serious flaws in a widely-deployed piece of enterprise networking software were being actively exploited in the wild, before the vendor had shipped a fix. The software in question is Citrix NetScaler, a product used by thousands of organisations worldwide to handle remote access and application delivery. Patches were not yet available when attackers started using these vulnerabilities. That gap, between a flaw being known and a patch being available, is exactly where criminals operate.
If you run a small business and have never come across NetScaler, you might think this story has nothing to do with you. In one sense, that is fair. NetScaler tends to show up in larger enterprise environments. But the pattern here, unpatched software actively exploited before the vendor catches up, is one of the most consistent threats in modern cybersecurity, and it touches businesses of every size.
What Remote Code Execution Actually Means
The flaws involved are described as remote code execution vulnerabilities. That phrase is worth unpacking, because it describes one of the worst possible outcomes in a security flaw. Remote code execution means an attacker, sitting anywhere in the world, can run their own commands on your system without needing physical access, without needing your password, and sometimes without you doing anything at all. No click required. No attachment opened. Just a vulnerable piece of software reachable over the internet.
When researchers at watchTowr disclosed these two vulnerabilities, they noted that exploitation had already started. That is not unusual. Attackers monitor the same security research channels that defenders do, and often move faster. The moment a flaw is known, the clock starts.
Why This Matters Beyond the Specific Product
The specific software here may not be in your network. But the lesson applies regardless. Many small businesses run internet-facing systems that they have not audited recently: firewalls bought three years ago and largely forgotten, remote access tools set up during a busy period and never reviewed, or software running on a server that nobody is actively monitoring. Each of those is a potential gap.
The uncomfortable truth is that attackers do not need to target your business specifically. They scan the internet constantly, looking for known-vulnerable software. If something in your network matches a signature they are looking for, you become a target whether you were chosen or not. As we explored in an earlier post on prioritising which vulnerabilities to fix first, the volume of disclosed flaws is genuinely difficult for any business to keep up with. The answer is not to fix everything at once. It is to know what you have, know what is exposed, and deal with the high-risk items fast.
What a Zero-Day Means for Your Patch Routine
A zero-day is a vulnerability for which no patch yet exists. That creates a specific problem: your usual patch routine cannot protect you, because there is nothing to apply. In that window, the options shift. You may be able to restrict access to the vulnerable system, apply a workaround the vendor recommends, or increase monitoring to catch exploitation attempts early. None of those options are available to you if you do not know the system exists or have not been watching for security advisories about it.
This is where vulnerability management earns its place. It is not just about running patches when they arrive. It is about maintaining visibility over what is running in your environment so that when a disclosure like this one comes out, you can answer the question quickly: do we have this? Is it exposed? What do we do right now?
Automated patching handles the routine well, and we have written before about why consistent patching matters every single month. But for zero-days and newly disclosed flaws, the human element still matters. Someone needs to be watching, and someone needs to act when a serious advisory drops.
Remote Access Is a Particularly Sensitive Area
NetScaler is used specifically for remote access and application delivery. That context matters. Remote access systems sit at the edge of your network by design. They are meant to be reachable from outside. That makes them a natural target, because they are both exposed and, if compromised, a direct path inward. If your business relies on secure remote access for staff working from home or across multiple sites, the software that enables that connectivity deserves close attention. It should be patched promptly, configured carefully, and monitored for unusual activity.
Practical Steps for UK Small Businesses
- Build a simple list of everything internet-facing in your environment: firewalls, VPNs, remote access tools, web servers. If you do not know what is exposed, you cannot protect it.
- Subscribe to security advisories from any vendor whose software you run. Most vendors publish these for free. When a critical advisory lands, check whether it applies to you the same day, not the same week.
- If a zero-day is confirmed for software you run, contact your IT provider immediately and ask specifically: what mitigations are available right now, before a patch arrives?
- Consider regular vulnerability scanning so that gaps are identified systematically rather than discovered after an incident.
- Make sure any remote access tools you use are on current, supported versions. End-of-life software does not receive patches at all, which means every future flaw is effectively a permanent zero-day.
The Honest Summary
Zero-days are frightening precisely because the normal defence, apply the patch, does not yet exist. But most businesses that suffer serious breaches are not hit because of exotic zero-days. They are hit because a known vulnerability was left unpatched for weeks, or because nobody was watching a system that had been quietly forgotten. The Citrix NetScaler situation is a sharp reminder of what the threat looks like at its most acute. The response to it, know what you have, reduce exposure, act fast when advisories land, is the same response that builds resilience against the much more common everyday threats too.
If you are not confident you have that picture across your own environment, that is worth addressing before the next advisory drops.