[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fENT29_0TLYBHhl5_pEvo5q5ZEEBmWNsQXoUVOGR89Yc":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"986ea458-2b9b-484b-8ba4-3dc77e7b3ab8","2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway","2026-010-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway-39b99b","On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CERT-EU recommends updating affected devices as soon as possible.","Citrix has released a security advisory detailing critical vulnerabilities in NetScaler ADC and NetScaler Gateway. CERT-EU is urging users to update affected devices immediately due to the severity of these flaws, including a memory overflow and an authentication bypass.","Citrix NetScaler ADC and Gateway have critical vulnerabilities, CERT-EU advises immediate updates.","https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-010\u002F","https:\u002F\u002Fcert.europa.eu\u002Ffiles\u002Fimages\u002Fcerteu_home_share-v2.png","2026-08-19T16:13:47+00:00","2026-10-31T10:00:29.349452+00:00",9,[17,20,22,25],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":27},"SIP ALG","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"cve","CVE-2026-19489","Memory overflow vulnerability in NetScaler ADC\u002FGateway",{"type":48,"value":52,"context":53},"CVE-2026-19490","Authentication bypass vulnerability in NetScaler ADC\u002FGateway",[23,18,21],{"controls":56,"vendors":140},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":116,"name":117,"problem":118,"products":119},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":129,"product_name":130,"url":131,"description":132},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":135,"url":138,"description":139},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[141],{"slug":142,"name":23,"logo_path":143,"roles":144},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":158},"critical-citrix-netscaler-flaws-demand-immediate-patching","Critical Citrix NetScaler Flaws Demand Immediate Patching","Citrix has disclosed critical vulnerabilities in NetScaler ADC and NetScaler Gateway, including a memory overflow and an authentication bypass — two flaw classes that can enable remote code execution and unauthorised access without valid credentials. These products are widely deployed as internet-facing network gateways, making them high-value targets for threat actors who actively exploit Citrix vulnerabilities within days of disclosure. The authentication bypass is particularly dangerous because it allows attackers to circumvent security controls entirely, potentially exposing internal networks. Delayed patching of perimeter appliances in this threat category has historically led to ransomware deployment and data exfiltration at scale. Organisations must treat critical advisories on gateway infrastructure as emergency-priority remediation items.",[151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":159,"PCI DSS Requirement 6":160,"NIST SP 800-53 SI-2: Flaw Remediation":161,"OWASP A06:2021 Vulnerable and Outdated Components":162,"CIS Control 7: Continuous Vulnerability Management":163,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":164,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":165},"NIS2 requires essential and important entities to implement policies on vulnerability handling and patching, making timely remediation of critical Citrix flaws a regulatory obligation for in-scope organisations.","Requirement 6 mandates that organisations protect systems against known vulnerabilities by installing applicable security patches, which is precisely the remediation action CERT-EU is urgently recommending here.","SI-2 requires organisations to identify, report, and correct information system flaws on a priority basis — directly addressing the need for emergency patching of critical gateway vulnerabilities like these.","Running unpatched versions of NetScaler ADC and Gateway is a direct instance of this risk category, where known vulnerabilities in components expose the entire organisation to compromise.","Regular vulnerability scanning and a defined remediation timeline would have ensured the critical NetScaler patches were identified and applied before attackers could exploit the disclosed flaws.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, which would have driven prompt action on Citrix's critical advisory.","The authentication bypass vulnerability directly undermines access control mechanisms; this framework function requires that authentication controls on critical systems are robust and monitored for weaknesses."]