NCSC Urges Immediate Patch Deployment for Citrix NetScaler ADC and Gateway Following Discovery of Critical Zero‑Day Vulnerabilities

The United Kingdom’s National Cyber Security Centre (NCSC) released a high‑priority advisory calling on every entity running customer‑managed Citrix NetScaler ADC or NetScaler Gateway devices to install the available patches immediately. This alert comes after eight vulnerabilities were made public, with two—CVE‑2026‑88771 and CVE‑2026‑88772—rated as critical and already observed being exploited in the wild.

NetScaler ADC (Application Delivery Controller) and Gateway units are commonly used across enterprise networks to deliver load‑balancing, secure remote connectivity, and application delivery functions. Positioned typically at the perimeter of an organization’s infrastructure, a breach of these appliances can give attackers a foothold for lateral movement, data theft, or ransomware deployment.

According to the NCSC notice, the two critical CVEs enable unauthenticated actors to run arbitrary code on the compromised devices. By exploiting these weaknesses, attackers can circumvent current authentication controls, potentially seizing complete command of the appliance and the traffic it processes. The other six flaws, although assigned lower severity scores, still present considerable danger, particularly when leveraged alongside the critical issues.

Citrix has published firmware releases that address all eight vulnerabilities, and the NCSC urges organizations to confirm their current software version against the vendor’s security bulletin. As an interim measure, the centre advises disabling any non‑essential services on the devices and limiting access to trusted IP ranges until the patches are installed.

Analysts in the security sector observe that the swift appearance of zero‑day attacks on network‑edge hardware signals a wider pattern of adversaries aiming at infrastructure elements that frequently escape conventional patch‑management processes. By zeroing in on customer‑managed installations, the NCSC underscores a vulnerability where firms depend on internal IT staff instead of vendor‑managed solutions, placing greater responsibility on internal security teams to keep pace.

Following the advisory, a number of UK government departments have launched coordinated patch‑deployment campaigns, and the NCSC has made direct technical support available to operators of critical national infrastructure. The centre also intends to keep watch on threat‑intelligence feeds for evidence of continued exploitation and will publish supplementary guidance should new indicators of compromise arise.

Security teams are recommended to regard the advisory as top‑priority, embedding the patch rollout within existing change‑management procedures to prevent service interruptions. Entities that do not promptly address the flaws may encounter regulatory examination under the UK’s cyber‑security framework, which mandates clear risk mitigation for identified threats.

While the patches are being deployed, the NCSC will keep evaluating the situation and may revise its advice as the threat environment evolves. Stakeholders are encouraged to remain alert, keep an accurate, current inventory of all NetScaler installations, and apply forthcoming firmware updates promptly to protect the integrity of their networks.