NCSC Warns of Active Exploitation Affecting Citrix NetScaler Systems

News dates and status

Announcement published: 28 September 2026. This is the advisory publication date, not a claimed start date for exploitation. This RDE report was prepared and source-checked on 8 October 2026. It reports the announcement as dated, rather than claiming that every planned change is already available.

What was announced

The NCSC warned UK organisations about vulnerabilities affecting customer-managed Citrix NetScaler ADC and Gateway. The advisory identifies two vulnerabilities as actively exploited. It directs defenders to the vendor bulletin and indicators of compromise, recommends investigation and mitigation, and calls for continued monitoring. The affected product and version details are available in the advisory. Read the primary source.

What remains uncertain

This warning does not mean every organisation uses an affected system or has been compromised. Applying an update alone is not evidence that a prior compromise has been ruled out. The linked advice can change; technical owners should use the current NCSC and vendor instructions rather than this short summary as a remediation runbook.

RDE practical interpretation

A small organisation needs a clear route from a public advisory to the person responsible for its systems. Ownership matters even when infrastructure is outsourced. An enquiry to a supplier should ask for the applicability assessment, action owner and evidence of completion, rather than an unexplained reassurance. This is RDE editorial interpretation, not a measured result, a vendor endorsement or a claim made by the announcing organisation.

What to check next

• Send the advisory link to your authorised IT or managed-service contact. Ask whether the product appears in your inventory.
• Request a dated applicability assessment. If affected, ask the technical owner to follow the current official mitigation and investigation guidance.
• Record the decision, action owner and review point. Let the responsible team assess outage and recovery arrangements before changing a live service.
• If compromise is suspected, follow the official reporting and incident-response route. Do not conduct unapproved testing of another organisation’s systems.

Check your learning

What evidence would you request from a supplier to distinguish “not affected” from “updated but investigation still pending”?

Source and update record

National Cyber Security Centre (28 September 2026), Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Checked 8 October 2026. Editorial review due 15 October 2026. Recheck sooner if the source changes. Any correction should state the changed fact and correction date; retain the original announcement date. Later readers should treat this as an archived report unless a dated update says otherwise. This review date does not mean an automatic monitoring service is running.

Cover image: AI-generated illustrative scene created specifically for this resource.