Citrix urges admins to patch new NetScaler flaws as soon as possible

Administrators must prioritize immediate patching to prevent unauthorized access to NetScaler ADC and NetScaler Gateway instances. Failure to apply updates leaves infrastructure exposed to potential remote code execution, as detailed by vulnerability researchers. The urgency stems from the disclosure of two high-severity flaws that target the authentication mechanisms of Gateway and AAA servers.

Citrix issued the call to patch following the identification of CVE-2026-8452 and CVE-2026-19490. According to CyberWire and BleepingComputer, the company explicitly requested that teams expedite remediation efforts to secure their systems. Rapid7 and The Hacker News confirm these vulnerabilities allow for pre-authentication bypass, creating a direct pathway for attackers to compromise systems without requiring standard credentials.

While patches are now available for deployment, coverage does not yet specify the full extent of active exploitation in the wild or the total number of devices currently at risk. Future updates from cybersecurity researchers at watchTowr Labs and other security entities will clarify if these vulnerabilities are being leveraged in targeted attacks against enterprise networks.