NCSC Calls for Urgent Patching of Citrix NetScaler ADC and Gateway After Critical Zero‑Day Flaws Discovered

The UK National Cyber Security Centre (NCSC) has issued an urgent advisory urging all organisations that operate customer‑managed Citrix NetScaler ADC and NetScaler Gateway appliances to apply patches without delay. The warning follows the disclosure of eight security flaws, two of which – identified as CVE‑2026‑88771 and CVE‑2026‑88772 – are classified as critical and are already being actively exploited in the wild.

NetScaler ADC (Application Delivery Controller) and Gateway devices are widely deployed in corporate networks to provide load‑balancing, secure remote access, and application delivery services. Because these appliances often sit at the edge of an organisation’s infrastructure, a successful compromise can give attackers a foothold for lateral movement, data exfiltration, or ransomware deployment.

The NCSC advisory details that the two critical CVEs allow unauthenticated attackers to execute arbitrary code on the affected systems. Exploitation of these flaws can bypass existing authentication mechanisms, potentially granting full control over the appliance and any network traffic it handles. The remaining six vulnerabilities, while rated lower, still pose significant risk, especially when combined with the critical flaws.

Citrix has released firmware updates that remediate all eight issues, and the NCSC stresses that organisations should verify the version of the software they are running against the vendor’s security advisory. The centre also recommends a short‑term mitigation: disabling any unnecessary services on the appliances and restricting access to trusted IP ranges until patches are applied.

Industry analysts note that the rapid emergence of zero‑day exploits against network‑edge devices reflects a broader trend of threat actors targeting infrastructure components that are often overlooked in traditional patch‑management cycles. By focusing on customer‑managed deployments, the NCSC highlights a gap where organisations may rely on internal IT teams rather than vendor‑managed services, increasing the onus on internal security operations to stay current.

In response to the advisory, several UK government departments have already begun coordinated patching efforts, and the NCSC has offered direct technical assistance to critical national infrastructure operators. The centre also plans to monitor threat‑intel feeds for signs of further exploitation and will issue follow‑up guidance if additional indicators of compromise emerge.

Security professionals are advised to treat the advisory as a high priority, integrating the patching process into existing change‑management workflows to avoid service disruption. Organizations that fail to remediate the vulnerabilities promptly could face regulatory scrutiny under the UK’s cyber‑security standards, which require demonstrable risk mitigation for known threats.

As the patches roll out, the NCSC will continue to assess the situation and may update its recommendations based on the evolving threat landscape. Stakeholders are urged to stay vigilant, maintain up‑to‑date inventory of all NetScaler deployments, and ensure that future firmware releases are applied in a timely manner to safeguard the integrity of their networks.