top of page
Search

Urgent Action Required: Unpatched Citrix NetScaler Flaws Under Active Exploitation

Writer: Vichitra Mohan
Vichitra Mohan
Oct 6
3 min read

If your organization relies on Citrix NetScaler Application Delivery Controller (ADC) or NetScaler Gateway to manage traffic and secure remote access, it's time to pull up your log management tools and call an emergency sync with your infrastructure team.


The Australian Cyber Security Centre (ACSC / Cyber.gov.au) issued a critical security advisory highlighting a batch of severe security vulnerabilities affecting NetScaler ADC and NetScaler Gateway deployments. Crucially, cybercriminals are already exploiting these flaws in the wild.   


Here is what you need to know about the risk, how to inspect your environment, and the immediate steps to take to secure your network perimeter.


What Is Happening?


Citrix released security patches addressing 8 distinct vulnerabilities across its NetScaler ADC and Gateway product suites.   


While several of these bugs require specific conditions to be exploitable, threat actors have already begun actively targeting vulnerable instances worldwide.   


Key Vulnerabilities at a Glance


  • CVE-2026-88771 (Remote Code Execution): The most alarming flaw in the advisory. It allows an unauthenticated, remote attacker to execute arbitrary system commands. Every configuration of NetScaler ADC and Gateway is vulnerable.   


  • CVE-2026-88772 & Remaining Vulnerabilities: Include high-severity flaws that can lead to credential theft, session hijacking, or full administrative takeover under specific configuration states.   


  • SAML Authentication Issue: A separate, newly identified flaw specifically impacting configurations that utilize SAML authentication. An unauthenticated remote attacker can exploit this issue to trigger system crashes, denial-of-service (DoS) conditions, or arbitrary code execution.   


Because perimeter security devices like ADC appliances and VPN gateways face the public internet directly, threat actors frequently target them as a primary entry point into internal corporate networks.   


Are Your Systems Vulnerable?


The advisory applies to all customer-managed implementations of Citrix NetScaler ADC and NetScaler Gateway.   


Affected Product Versions


If you run any of the following software versions, your appliances require immediate patching:


  • NetScaler ADC / Gateway 14.1 (Versions prior to 14.1-73.41)   


  • NetScaler ADC / Gateway 13.1 (Versions prior to 13.1-64.28)   


  • NetScaler ADC FIPS / NDcPP variants corresponding to the affected release lines   


Note on End-of-Life (EOL) Builds: Older builds (such as NetScaler 12.1 and 13.0) no longer receive active security updates. If you still run legacy versions in production, you must migrate to a supported release immediately to receive protective patches.   

Immediate Remediation Steps


1. Apply Official Patches


Prioritize patching all internet-facing NetScaler ADC and Gateway appliances as soon as possible. Check the Citrix Knowledge Center or NetScaler Console for the latest release downloads for your specific deployment.   


2. Audit Your Appliance Configuration


Because 7 of the 8 CVEs rely on specific feature flags or authentication modes to be exploitable, inspect your running configurations:   


  • Check whether SAML Authentication (either as an Service Provider or Identity Provider) is active (add authentication samlAction / add authentication samlIdPProfile).   


  • Verify whether AAA virtual servers, ICA Proxy, or Gateway functions are exposed directly to the public internet.


3. Hunt for Signs of Compromise


Because active exploitation occurred before patches were published, patching alone isn't enough. You must verify whether your network was breached prior to updating.   


  • Log Review: Audit syslog and NetScaler Console event logs back to early September 2026. Look for unexpected reboot cycles, core dumps, anomalous web traffic targeting administrative endpoints, or unfamiliar shell command execution.


  • Session Verification: Inspect active user sessions for abnormal geographic access patterns or administrative account creations that lack internal change requests.


4. Engage Managed Service Providers (MSPs)


If your IT infrastructure or Citrix stack is managed by a third party, reach out to them immediately. Confirm that they have patched your instances and requested proactive threat hunting across your dedicated environment.   


Reporting & Getting Help


If you identify suspicious activity or suspect your Citrix appliances have been compromised:


  • In Australia: Report the incident directly to the Australian Cyber Security Centre via Cyber.gov.au or call their hotline at 1300 CYBER1 (1300 292 371).


  • Global Teams: Reach out to your national Computer Emergency Response Team (CERT) or cybersecurity agency and open a priority ticket with Citrix Technical Support.


Don't wait for your scheduled maintenance window—edge devices face automated exploitation scripts within hours of CVE announcements. Verify your version numbers and update your NetScaler nodes today.   

 
 
 

Comments

bottom of page