Advisory hub
Citrix NetScaler ADC and Gateway Vulnerabilities and Patches
5 advisories
NetScaler ADC and NetScaler Gateway terminate remote access and SAML sign-in for thousands of organisations, and memory-safety flaws in them have repeatedly been exploited within days of disclosure. Session tokens taken from an unpatched appliance can outlive the patch, which is why Citrix advisories often tell administrators to kill active sessions after upgrading.
Each row below is a NetScaler advisory we have covered, with the fixed build and links to the post-patch steps.
Advisories
| ID | Product & issue | Severity | KEV | Fix | Published |
|---|---|---|---|---|---|
| CVE-2026-88779 | Citrix NetScaler SAML DoS | High | No | 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282 FIPS/NDcPP | |
| CVE-2026-88771 | Citrix NetScaler ADC RCE | Critical | No | See remediation | |
| CVE-2026-8452 | Citrix NetScaler Buffer Overflow | High | Yes | Vendor advisory | |
| CVE-2026-19490 | Citrix NetScaler Auth Bypass | Critical | Yes | Vendor advisory | |
| — | Twelve Zero-Days Weaponized in One Week Across Citrix, Cisco and Fortinet | Critical | Yes | Vendor advisory |
KEV: listed in CISA's Known Exploited Vulnerabilities catalog. “No” means not listed when we published, not that the flaw is safe to defer.
You're on the list.
We'll email you when the next issue goes out.
Free newsletter
The Daily Brief
The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.
- Exploited CVEs, with affected products and patch status
- Patch priorities ranked by real-world exploitation
- Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2
Free