Citrix releases critical security patch for NetScaler ADC and Gateway

Citrix has issued a critical security warning and patch for customers managing NetScaler ADC and NetScaler Gateway instances. CSO Online reported that this is the third consecutive week Citrix has released a critical security advisory for these products. Network World and CyberSecurityNews both report that the critical patch addresses a new remote code execution flaw. [1][2][3]

According to CSO Online, the flaw is a memory overflow vulnerability that enables denial of service or remote code execution. The vulnerability affects NetScaler ADC and NetScaler Gateway when the systems are configured as a Security Assertion Markup Language identity provider. CSO Online noted that older versions are also vulnerable when configured for SAML identity provider functions. [2]

NetScaler is a line of networking products owned by Cloud Software Group, which was formed following a private merger in 2022. As FTMQ Security reported earlier, Citrix previously released emergency updates for a zero-day denial of service vulnerability in NetScaler ADC and Gateway tracked as CVE-2026-88779. [4][5]

Citrix urges customers who manage their own NetScaler ADC and NetScaler Gateway instances to apply the security updates immediately, according to CyberSecurityNews and CSO Online. Security teams must update vulnerable instances to prevent potential service disruptions or unauthorized code execution. [2][3]