Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Urgent: Security Flaw Found in Citrix NetScaler Products

A serious security weakness has been found in Citrix NetScaler ADC and Gateway devices that could let attackers bypass important security controls. This matters because many small businesses use these products to manage internet traffic and remote access, so the flaw could expose sensitive information or allow unauthorised access.

29 September 2026

Reference: CVE-2026-88774

1. What is being reported?

Researchers have discovered a vulnerability in certain versions of Citrix NetScaler ADC and Gateway software. The problem involves the way these products handle web address rules, allowing attackers to bypass security policies that should restrict access.

2. What this means in plain English

If your organisation uses affected Citrix NetScaler devices, attackers might be able to get around your security settings and access parts of your network or data they shouldn’t. This could lead to data breaches or disruptions.

3. Could this affect a small business?

Small businesses that use Citrix NetScaler ADC or Gateway devices with versions older than those fixed in recent updates could be at risk. If you do not use these products, or your software is up to date, you are likely not affected.

4. What to do now

  • Check if your organisation uses Citrix NetScaler ADC or Gateway devices.
  • Ask your IT provider if your Citrix NetScaler software is updated to the latest secure versions.
  • If not updated, arrange for immediate software updates or patches from Citrix.
  • Monitor your network for unusual activity and review access controls.

5. Ask your IT provider

Can you confirm whether our Citrix NetScaler ADC and Gateway devices are running versions affected by CVE-2026-88774, and if they have been patched to fix this vulnerability?

6. Bottom line

Make sure your Citrix NetScaler devices are updated promptly to prevent attackers bypassing your security controls.

Information based on CISA KEV, NVD, and reputable security reports.

Back to Vulnerability Briefs