NetScaler ADC
Citrix application delivery and remote-access gateway appliance, sold by Cloud Software Group.
NetScaler ADC has collected six entries on CISA's exploited-vulnerability list in 2026, five of them between 26 August and 4 October, and on 28 September Britain's NCSC told owners to isolate or replace affected appliances rather than simply patch.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why does NetScaler's SAML login keep producing critical vulnerabilities?
Timeline for NetScaler ADC
Citrix replaces its own NetScaler fix
Cybersecurity: Threats and DefencesJPCERT alerts on NetScaler after watchTowr proof
Cybersecurity: Threats and DefencesContained critical memory overread vulnerability in SAML IdP configuration path
Cybersecurity: Threats and Defences: CitrixBleed 3 lands on SAML brokerBackground
NetScaler ADC is the application delivery controller in Citrix's range, now sold by Cloud Software Group. It balances traffic to applications and, configured as a gateway, handles remote access and sign-in for every system behind it, often as the SAML identity provider for enterprise single sign-on. On a NetScaler ADC, one flaw can therefore open the whole network behind it.
CISA has tracked exploited NetScaler bugs since the first CitrixBleed in October 2023. CVE-2026-3055, dubbed CitrixBleed 3, a 9.3-rated memory overread on appliances acting as a SAML identity provider, was disclosed on 23 March 2026 and added to the catalogue on 30 March, the third critical memory bug in the product family in 30 months. Citrix first classed CVE-2026-8452 as a denial-of-service bug on 30 June; WatchTowr Labs proved code execution on 14 August, and JPCERT/CC warned Japanese users the next day.
The NCSC has issued alerts through each CitrixBleed wave. Its 28 September 2026 alert told UK organisations to isolate or replace affected appliances, hunt with Citrix's indicators of compromise, report suspected breaches and only then install the latest updates.
NetScaler ADC logs six exploited flaws
The autumn run began when CISA listed CVE-2026-8452 on 26 August, followed by CVE-2026-19490, an authentication bypass, on 9 September. On 27 September two more arrived together: CVE-2026-88771, rated 9.5 and open to unauthenticated command execution in a default setup, and CVE-2026-88772, both attacked before fixes shipped in builds 14.1-73.37 and 13.1-64.23.
CVE-2026-88779, a memory overflow on SAML-configured units, made six on 4 October and pushed the minimum SAFE builds to 14.1-73.41 and 13.1-64.28. CISA gave federal agencies three days for each 2026 listing, and three of them also carry the forensic triage requirement of directive BOD 26-04. Rapid7 found stolen NetScaler configuration files holding directory passwords and private keys, so an updated appliance can still leak through secrets copied earlier.
What is NetScaler ADC used for?
Is NetScaler vulnerable in 2026?
Which NetScaler builds fix the September and October 2026 flaws?
What is CitrixBleed 3?
What did the NCSC tell UK NetScaler users to do in September 2026?
