CISA Warns of Citrix NetScaler ADC and Gateway Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Citrix NetScaler ADC and NetScaler Gateway security flaw, tracked as CVE-2026-8452, to its Known Exploited Vulnerabilities catalog after confirming exploitation in attacks.

The vulnerability was added on August 26, 2026, and federal civilian executive branch agencies must apply the vendor-recommended mitigations by August 29, 2026.

CISA’s listing signals that the issue presents an immediate operational risk, particularly for organizations that expose NetScaler appliances to the internet.

CVE-2026-8452 is an improper restriction of operations within the bounds of a memory buffer vulnerability, classified as CWE-119. The flaw affects Citrix NetScaler ADC and NetScaler Gateway products. It can allow an unauthenticated attacker to trigger a denial-of-service condition.

Citrix NetScaler ADC and Gateway Vulnerability Exploited

A successful exploit could cause a targeted appliance to become unavailable, interrupting access to applications, remote services, authentication portals, and network resources routed through the affected NetScaler instance.

Since NetScaler ADC and Gateway deployments are commonly placed at the network edge, an outage could disrupt both internal staff and external users.

CISA has not stated whether the vulnerability is being used in ransomware campaigns. The agency also noted that mandatory forensic triage is not required under its BOD 26-04 implementation guidance.

However, organizations should still review appliance logs, system alerts, traffic anomalies, and recent availability incidents to identify potential exploitation attempts.

The warning is especially important because edge devices remain high-value targets for threat actors. Internet-facing gateways can provide access to remote applications, VPN services, single sign-on systems, and other business-critical infrastructure.

Even when a vulnerability is limited to denial-of-service, repeated exploitation can create significant operational disruption. It may be used alongside other intrusion activity.

Citrix has published mitigation guidance in advisory CTX696604. Administrators should identify all NetScaler ADC and Gateway assets, confirm whether they are affected, and apply the vendor’s recommended updates or mitigations without delay.

Organizations should also verify internet exposure, restrict administrative interfaces, and ensure that management services are not publicly accessible unless necessary.

CISA instructed agencies to follow its Binding Operational Directive 26-04, which prioritizes security updates based on risk. The directive requires stakeholders to evaluate each affected asset’s exposure and patching urgency.

Where mitigations are unavailable, agencies and organizations should consider removing the vulnerable product from service until a secure remediation path is available.

Security teams should monitor NetScaler availability, review web and authentication logs, and retain relevant telemetry in case further details on attack activity emerge.

Organizations using managed or cloud-hosted NetScaler services should also confirm with their provider whether mitigations have been deployed.

CISA’s rapid deadline highlights the need for defenders to treat CVE-2026-8452 as an active security issue rather than a routine maintenance task.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC