CERT-EU 2026-09-27

2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

Machine-generated analysis · WAYSCloud LLM

Two unauthenticated RCE vulnerabilities in Citrix NetScaler ADC and Gateway are confirmed to be exploited in the wild.

Context

The advisory concerns customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway devices. It reports eight vulnerabilities, including two critical unauthenticated remote code execution flaws that are actively being exploited. CERT-EU advises updating the software and performing a compromise assessment on internet-exposed instances.

Operator considerations

Check: Identify NetScaler ADC and Gateway instances and their software versions.
Isolate: Restrict internet-facing NetScaler devices until they are patched.
Patch: Apply the updates provided by Citrix for the affected products.
Log: Review logs for signs of exploitation attempts against the vulnerable services.

From Computer Emergency Response Team for the EU institutions ↗

On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild.

CERT-EU recommends updating affected software and running a compromise assessment on those exposed on the internet.

Read the full advisory on CERT-EU →