In the first days after the NetScaler alerts, an owner has three jobs: list every appliance and its version, check for compromise before patching, and keep management services off the public internet. CISA, NCSC UK, the Canadian Cyber Centre and Citrix all point that way. Patching alone is not enough, because the Cyber Centre warns that persistence may survive updates.
Earlier NetScaler flaws exploited in the wild have their own pages: Citrix Bleed (CVE-2023-4966), CVE-2023-3519 and Citrix Bleed 2 (CVE-2025-5777).
What happened, and what do the agencies say?
CISA says Citrix disclosed eight new vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them are listed in CISA’s Known Exploited Vulnerabilities catalog, and CISA calls them critical zero-days that can each allow remote code execution. CISA also says it has reports and partner intelligence confirming active exploitation worldwide.
NCSC UK says organizations running these products on premises are affected. The Cyber Centre says exploitation was seen worldwide but its extent is unknown. No group has been named: there is no public attribution. The full chain of events is on our Citrix NetScaler incident page.
- 2026-09-27Citrix bulletin and blogThe Cyber Centre dates its alert AL26-024 the same day.
- 2026-09-27CISA adds CVE-2026-88771 to KEVNVD shows the KEV addition on this date.
- 2026-09-28NCSC UK alertTwo of the eight CVEs confirmed as actively exploited.
- 2026-10-02CISA adds a SIGMA detection rule resourceCitrix also publishes guidance on a separate SAML-related issue.
- 2026-10-04CISA adds CVE-2026-88779 to KEVA later NetScaler denial-of-service flaw.
Which NetScaler appliances do we run, and which builds are affected?
The first question for your team is a simple one: can someone list every customer-managed NetScaler ADC and Gateway appliance, including FIPS builds, with its version? NCSC UK lists these builds as affected: 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and FIPS and NDcPP builds before 13.1-37.279.
If the list lives in several places, or nobody owns it, that is the finding. A second question follows: when the KEV listing appeared on 27 September, how long did it take for the right person to see it?
Should we check for compromise before we patch?
CISA encourages users to check for indications of compromise before patching, if possible. It also says to preserve forensic evidence before applying updates, because updates may cause a loss of forensic visibility. CISA notes that updating NetScaler can be complex and may need downtime, so the order of work needs a plan in advance.
Citrix has made indicators of compromise available through NetScaler Console, and NCSC UK advises investigating with them. It also points to File Integrity Monitoring in NetScaler Console. CISA’s alert was updated on 2 October with a SIGMA detection rule resource.
- Find every NetScalerList all customer-managed ADC and Gateway appliances, including FIPS builds.
- Compare versionsCheck each against the builds NCSC UK lists as affected.
- Run the IOC checkUse the NetScaler Console indicators before patching, as CISA and NCSC UK advise.
- Preserve evidenceKeep logs, remote syslog and support bundles before you reboot or patch.
- Look for persistenceReview the places the Cyber Centre lists, such as startup scripts and scheduled tasks.
Is a patched NetScaler a clean NetScaler?
Not necessarily. The Cyber Centre warns that patching alone may not clean a compromised appliance, that persistence may survive updates, and that some suspicious activity may predate the fixes. So the question for your team is whether logs from before the fix were reviewed, not only logs from after it.
If an appliance is suspect, Citrix guidance says to take it off the network, change service account passwords and secrets stored on it, revoke the certificates and keys stored on it, and watch a rebuilt system for at least 90 days. NCSC UK advises isolating and replacing affected systems where possible. Cloud Software Group recommends replacing a compromised VPX instance. The Cyber Centre also says to consider shutting internet-facing appliances down until fixes are applied.
One more check: the Cyber Centre says the fixes for the two exploited flaws do not fix the separate SAML-related denial-of-service issue Citrix described on 2 October. Does your plan cover both?
Are our management interfaces reachable from the internet?
Citrix guidance says NetScaler management services must never face the public internet. That turns into a check any owner can run: can anyone outside our network reach the management interface of any appliance on the list?
How could threat intelligence monitoring give early warning?
Monitoring cannot stop an attack, and no outcome is promised. What it can do is flag new vulnerability alerts and KEV additions for the products you run, so the person who owns the inventory hears about them on the day they appear. Here that day was 27 September, when the Cyber Centre and CISA alerts and the KEV listing all appeared.
It can also show exposed credentials that might follow an edge-device compromise. Combined with a look back through logs that predate the fix, this helps answer the buyer’s real question: how fast do we learn that an internet-facing product we run is being exploited, and can we look back for earlier signs?
For another edge-device case, see our Cisco SD-WAN 2026 incident page.
Related reading: two Fortinet events of 2026 and exposed PLCs and the 2026 US advisory.