What Happened
The latest NetScaler ADC vulnerability warning comes from CERT-EU, based on two Citrix advisories. On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CERT-EU advised updating affected devices as soon as possible.
On 27 September 2026, Citrix published a security bulletin covering 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. According to CERT-EU, two of those vulnerabilities are critical unauthenticated remote code execution flaws, and Citrix has confirmed active exploitation in the wild. CERT-EU recommends updating the affected software and running a compromise assessment on devices exposed to the internet.
The second advisory changes the risk equation. A critical unauthenticated RCE that is being exploited in the wild means attackers do not need credentials to gain code execution. For MSPs, the practical effect is that every internet-facing NetScaler appliance should be treated as potentially compromised until proven otherwise.
Timeline
- 19 August 2026: Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC and NetScaler Gateway.
- 27 September 2026: Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, including two critical unauthenticated RCE vulnerabilities with confirmed active exploitation.
Who Is Affected
If you run customer-managed NetScaler ADC or NetScaler Gateway, you are in the affected population. The September bulletin specifically covers customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. The August advisory names the same product families.
CERT-EU says customer-managed devices, which is worth checking in your contracts. If a vendor or Citrix manages the appliance, confirm with them that the update and the compromise assessment are complete. If you manage it, the responsibility is yours.
These products often sit in front of client applications, remote access and VPN traffic. An internet-exposed NetScaler appliance is an attractive target, so treat the affected list as urgent and verify every instance you manage.
NetScaler ADC Vulnerability Technical Details
CERT-EU names the products as NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). The September bulletin covers 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. Two are described as critical unauthenticated remote code execution vulnerabilities, with active exploitation confirmed by Citrix.
CERT-EU's public advisories do not list CVE identifiers or affected version numbers. The exact identifiers, affected builds and patch releases are in the Citrix security bulletin that CERT-EU cites.
What to Do This Week
Treat this as a two-part job: patch, then check whether you were already compromised. Here is the order for this week.
- Update every affected NetScaler ADC and NetScaler Gateway device as soon as possible, following the Citrix advisory for your exact version.
- Run a compromise assessment on any NetScaler appliance exposed to the internet, as CERT-EU recommends. Do this even if the device has already been updated.
- Check your asset inventory for every customer-managed NetScaler ADC and Gateway instance, including test, DR and remote site appliances.
- As a standing practice, restrict management access to trusted networks and enforce multi-factor authentication on administrative accounts.
- Review authentication and VPN logs for unusual activity, such as unexpected source IPs, off-hours logins or new accounts.
- Monitor the Citrix advisory and CERT-EU pages for updates, and be ready to patch again if additional fixes are released.
What to Tell Clients
Citrix has published a security bulletin for customer-managed NetScaler ADC and NetScaler Gateway. It covers eight vulnerabilities, two of which are critical unauthenticated remote code execution flaws. Citrix has confirmed these two are being actively exploited.
If your environment includes NetScaler ADC or NetScaler Gateway, we are updating those devices and running a compromise assessment because they may have been exposed to the internet.
We will let you know if we find anything suspicious. If you are not sure whether you use these products, ask us and we will check your environment.
The Bottom Line
This is a confirmed, actively exploited vulnerability in products that sit at the edge of client networks. Update affected devices first, then run the compromise assessment. The time to act is this week, not after an incident.
Frequently Asked Questions
What Is the NetScaler ADC Vulnerability?
CERT-EU published two advisories after Citrix disclosed critical vulnerabilities in NetScaler ADC and NetScaler Gateway. The September bulletin covers eight vulnerabilities, including two critical unauthenticated remote code execution flaws. Citrix has confirmed active exploitation of those two in the wild.
Is the NetScaler Gateway Vulnerability Being Exploited?
Citrix has confirmed active exploitation of the two critical unauthenticated remote code execution vulnerabilities in customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway. CERT-EU repeats that confirmation in its advisory. That is why a compromise assessment is recommended, not just a patch.
Which NetScaler Products Are Affected?
The affected products are NetScaler ADC, formerly Citrix ADC, and NetScaler Gateway, formerly Citrix Gateway. The September bulletin specifically addresses customer-managed instances of both products.
What Should an MSP Do About This Vulnerability?
Update affected NetScaler ADC and NetScaler Gateway devices as soon as possible, and run a compromise assessment on any appliance exposed to the internet. Also check your inventory for every customer-managed instance, including test and DR appliances. Patch first, then look for signs of compromise.
Are There CVE Identifiers for This NetScaler Vulnerability?
CERT-EU's public advisories do not list CVE identifiers or affected version numbers. Check the Citrix security bulletin cited by CERT-EU for the exact identifiers, affected builds and patch releases.