NCSC urges UK organisations to mitigate exploited Citrix NetScaler vulnerabilities

What happened

• The advisory was published on 28 September 2026.
• UK organisations are instructed to apply vendor patches or mitigations without delay.
• Failure to act could increase the risk of compromise across critical services.

Why it matters

Any UK entity running Citrix NetScaler must verify that the latest security updates are installed, as attackers are already targeting the flaws.

Business impact

Unpatched systems may suffer data breaches or service disruption, leading to operational downtime and potential regulatory scrutiny.

What to check

1. 1

   apply patchesHigh priority

   Download and install the Citrix‑released patches for the affected NetScaler ADC and Gateway versions immediately.

2. 2

   verify remediationHigh priority

   Run vulnerability scans to confirm the patches have been applied and the flaws are no longer present.