NCSC Urges Immediate Patch Deployment for Citrix NetScaler ADC and Gateway After Critical Zero‑Day Vulnerabilities Discovered

The UK National Cyber Security Centre (NCSC) has issued an urgent advisory urging all organisations that run customer‑managed Citrix NetScaler ADC and NetScaler Gateway appliances to install patches without delay, after the disclosure of eight security flaws, two of which – CVE‑2026‑88771 and CVE‑2026‑88772 – are deemed critical and are already being actively exploited in the wild.

NetScaler ADC (Application Delivery Controller) and Gateway units are widely deployed across corporate networks to provide load‑balancing, secure remote access and application delivery services. Because these devices often sit at the edge of an organisation’s infrastructure, a successful breach can give attackers a foothold for lateral movement, data exfiltration or ransomware deployment.

The NCSC advisory explains that the two critical CVEs permit unauthenticated attackers to execute arbitrary code on the affected systems. Exploiting these flaws can bypass existing authentication mechanisms, potentially granting full control of the appliance and any traffic it handles. The other six vulnerabilities, while rated lower, still represent a considerable risk, especially when chained with the critical issues.

Citrix has published firmware updates that remediate all eight problems, and the NCSC advises organisations to verify their software version against the vendor’s security advisory. As a short‑term mitigation, it recommends disabling any unnecessary services on the appliances and restricting access to trusted IP ranges until the patches are applied.

Industry analysts observe that the swift appearance of zero‑day exploits targeting network‑edge devices reflects a broader trend of threat actors focusing on infrastructure components that are often overlooked in traditional patch‑management cycles. By highlighting customer‑managed deployments, the NCSC points to a gap where firms may rely on internal IT teams rather than vendor‑managed services, increasing the burden on internal security operations to stay current.

In response, several UK government departments have already launched coordinated patching efforts, and the NCSC is offering direct technical assistance to operators of critical national infrastructure. The centre also plans to monitor threat‑intel feeds for further signs of exploitation and will issue follow‑up guidance if additional indicators of compromise emerge.

Security professionals are urged to treat the advisory as a top priority, embedding the patching process into existing change‑management workflows to avoid service disruption. Organisations that fail to remediate the vulnerabilities promptly could face regulatory scrutiny under the UK’s cyber‑security standards, which require demonstrable risk mitigation for known threats.

As the patches are rolled out, the NCSC will continue to assess the situation and may update its recommendations as the threat landscape evolves. Stakeholders are encouraged to stay vigilant, maintain an up‑to‑date inventory of all NetScaler deployments, and ensure that future firmware releases are applied promptly to protect the integrity of their networks.