CISA issues urgent alert about vulnerabilities in remote access technology used by businesses

The Cybersecurity and Infrastructure Security Agency has issued an urgent alert critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that attackers are actively exploiting. Banks are being asked to take immediate action to protect their systems. Citrix provides technology that organizations use to deliver applications and enable remote access to their systems. Its NetScaler products often sit at the entrance to an organization’s network, managing connections between outside users and internal applications. The vulnerabilities exploit flaws in how affected devices process incoming data, allowing attackers to run malicious commands without a valid username or password — and without an employee clicking a link or taking any other action. Citrix said the vulnerabilities were discovered using artificial intelligence. To address the potential effects for the banking sector, the American Bankers Association engaged with the Financial Services Sector Coordinating Council, which coordinates industry efforts to protect financial infrastructure, and the Financial and Banking Information Infrastructure Committee, which coordinates financial regulators’ efforts to strengthen sector resilience. ABA also participated in a Core Executive Response Group call to assess potential impacts and coordinate the sector’s response. Banks should immediately identify affected systems, apply the updates outlined in the Citrix security bulletin, and investigate whether attackers gained access before the updates were installed, according to CISA and the other agencies. Patching addresses the vulnerability but does not, by itself, remove an attacker who may already have established access. In addition, banks should assess their exposure through technology providers even if they do not use NetScaler themselves. Banks should directly their managed IT providers, core processors, hosted application providers, and other vendors that hold bank data or have access to bank systems to determine whether they use affected products.

Citrix provides technology that organizations use to deliver applications and enable remote access to their systems. Its NetScaler products often sit at the entrance to an organization’s network, managing connections between outside users and internal applications. The vulnerabilities exploit flaws in how affected devices process incoming data, allowing attackers to run malicious commands without a valid username or password — and without an employee clicking a link or taking any other action. Citrix said the vulnerabilities were discovered using artificial intelligence.

To address the potential effects for the banking sector, the American Bankers Association engaged with the Financial Services Sector Coordinating Council, which coordinates industry efforts to protect financial infrastructure, and the Financial and Banking Information Infrastructure Committee, which coordinates financial regulators’ efforts to strengthen sector resilience. ABA also participated in a Core Executive Response Group call to assess potential impacts and coordinate the sector’s response.

Banks should immediately identify affected systems, apply the updates outlined in the Citrix security bulletin, and investigate whether attackers gained access before the updates were installed, according to CISA and the other agencies. Patching addresses the vulnerability but does not, by itself, remove an attacker who may already have established access.

In addition, banks should assess their exposure through technology providers even if they do not use NetScaler themselves. Banks should directly their managed IT providers, core processors, hosted application providers, and other vendors that hold bank data or have access to bank systems to determine whether they use affected products.

Nano Banc in California closed by regulators

California regulators on Friday closed Nano Banc of Irvine and appointed the FDIC as receiver. Sunwest Bank of Sandy, Utah, has agreed to assume substantially all deposits and purchase certain assets of the bank.

Final: Consumer sentiment decreased 3.6 points in September

Consumer sentiment decreased 3.6 points month-over-month in September to 48.1, and is down seven points from one year ago, according to final results of the University of Michigan Surveys of Consumers.

ABA DataBank: Protein obsession drives up prices

Demand for protein-rich foods and nutritional supplements has continued to increase, contributing to tighter whey inventories and higher prices.

House Democrats criticize proposed changes to CRA regulations

The Democratic members of the House Financial Services Committee warned banking regulators against “weakening” the Community Reinvestment Act and requested more time for public on proposed changes to rules implementing the law.

ABA, associations urge OCC to broaden application process for stablecoin issuers

As it seeks to implement the Genius Act, the OCC should consider additional factors when reviewing applications from non-bank entities requesting to become payment stablecoin issuers, and it should seek public on those applications, ABA and three...

FTC to explore curbing digital advertising practices that enable impersonation scams

The Federal Trade Commission said it will explore possible rulemaking to prevent online platforms from using ad-optimization practices that exacerbate impersonation scams. ABA welcomed the announcement.