Citrix NetScaler: Active Attack on VPN Gateway Flaw

A critical security flaw in Citrix NetScaler – used by many businesses as their remote access gateway – is now being actively exploited by attackers. If your business uses NetScaler for VPN or remote working access, this needs your attention today.

What has happened?

Citrix disclosed a vulnerability tracked as CVE-2026-19490 in NetScaler ADC (Application Delivery Controller) and NetScaler Gateway in August 2026. The flaw scores 9.3 out of 10 on the standard severity scale (known as CVSS), which places it firmly in the “critical” category.

NetScaler ADC and NetScaler Gateway are Citrix products used by thousands of organisations to provide secure, managed remote access to business applications. Think of them as the front door for staff logging in from home or on the road.

The vulnerability is an authentication bypass. That means an attacker does not need a username or password to exploit it; they can skip the login process entirely. The flaw affects appliances configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy, or an AAA virtual server – which covers the most common ways businesses deploy these products.

The timeline tells its own story:

• 19/20 August 2026 – Citrix releases patches for affected versions
• 2 September 2026 – A working proof-of-concept exploit is published publicly on GitHub
• 3 September 2026 – Active attacks confirmed in the wild
• 9 September 2026 – Added to the US CISA Known Exploited Vulnerabilities (KEV) catalogue, a global signal that a flaw is being actively weaponised

Why does this matter to your business?

Remote access gateways are high-value targets precisely because they sit between the open internet and your internal network. A successful exploit does not just mean one compromised account. It can give an attacker a foothold from which to move across your systems, steal data, or deploy ransomware.

The gap between patch release and public exploit was less than two weeks. In that window, attackers tested the flaw and built automated tools to scan for vulnerable gateways. Any organisation that had not applied Citrix’s August patches before 2 September was exposed to a publicly documented attack method.

Citrix NetScaler is particularly common in businesses with large remote working setups and in regulated sectors such as legal, financial services, healthcare, and manufacturing, or those using Citrix Virtual Apps and Desktops. If you are not certain whether your business uses it, your IT team or managed service provider should be able to confirm this quickly.

What should you do?

If you manage NetScaler yourself, update immediately to the following fixed versions or later:

• NetScaler ADC and Gateway 14.1 – update to version 14.1-73.32 or later
• NetScaler ADC and Gateway 13.1 – update to version 13.1-63.21 or later

After patching, review your NetScaler access logs for unusual authentication events or unexpected session activity going back to at least 2 September 2026, when the public exploit appeared.

If you use a managed IT provider, ask them to confirm your NetScaler appliance is on a patched version and that they have reviewed gateway logs for signs of compromise.

If you are unsure whether you use NetScaler, speak with your IT team. The product sometimes appears under different names depending on your licensing arrangements with Citrix.

The bigger picture

This incident is a reminder that internet-facing devices – firewalls, VPN gateways, remote desktop gateways – need urgent, prioritised patching. They are the most consistently targeted category of device in current threat actor playbooks, and a single unpatched flaw at the perimeter can leave everything behind it vulnerable.

Our IT security services include monitoring and patching for gateway and perimeter devices, and our team reviews advisories like this one as they emerge. As part of our managed IT services, we track critical CVEs and act quickly to ensure clients on our monitoring plans are protected.

For businesses wanting a more structured approach to security hygiene, a Cyber Essentials certification addresses exactly the patching, access control, and boundary protection requirements that directly reduce exposure to vulnerabilities like this one.

If you would like us to check whether your business is affected, or if you want a second opinion on your remote access security, get in touch or call 01452 701355 for a no-obligation chat.