Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products, several intrusions in Finland

New information on 3 October 2026: A new security issue related to SAML authentication has been identified in Citrix NetScaler. Citrix has published a preliminary advisory on a security issue related to SAML authentication in NetScaler products. Citrix is preparing a separate security bulletin and another set of patched software versions to address the issue. The issue affects devices that use SAML authentication. The vulnerability depends on the configuration and does not affect all NetScaler installations. Read more about the impact of the security issue in the updated vulnerability bulletin 2026/30 (in Finnish). 

What do we know about the vulnerabilities?

Citrix released several critical security fixes for NetScaler ADC and NetScaler Gateway products on 27 September 2026. The vulnerabilities include flaws related to remote code execution, HTTP request smuggling, memory corruption and the bypassing of security mechanisms. Organisations of different sizes use the products to provide secure remote access for their employees.

The most severe vulnerability, CVE-2026-88771, may allow commands to be executed on the target system without authentication. Several of the other vulnerabilities may lead to denial-of-service conditions, system instability or other attacker-controlled activity.

The NCSC-FI has received reports of exploitation of the vulnerabilities, meaning intrusions in Finland. Exploitation began before Citrix released the patches. Organisations should assume that internet-facing NetScaler systems may have been exposed to attack attempts. The intrusions in Finland underline the need for organisations using these products to investigate their environments even if they have already installed the updates.

The NCSC-FI has identified hundreds of Citrix NetScaler ADC and Gateway instances in Finland and contacted the device owners to remediate the vulnerabilities and prevent exploitation attempts. With this alert, the NCSC-FI aims to underline the importance of both patching and investigating. Even if the patches were installed quickly, organisations must still investigate their systems to detect any possible intrusion. Zero-day vulnerabilities are a threat to every organisation.

What should organisations do?

The NCSC-FI recommends the following actions:

• Update all vulnerable NetScaler ADC and NetScaler Gateway systems immediately to software versions patched by the vendor.
• Investigate whether the systems have been subject to suspicious activity or attack attempts.
• Review logs and administrative changes to detect possible intrusions.
• Check user accounts created on the servers, scheduled tasks, services, start-up scripts and other changes that could enable persistence.
• Change the passwords of administrative accounts if you suspect a compromise.
• Check whether an attacker could have used the system as a route into other systems on the internal network.

Updating the software alone does not remove the consequences of a possible earlier intrusion. An attacker may have attempted to establish a foothold by exploiting the zero-day vulnerability. Organisations must make sure that the system was not successfully exploited before the patch was installed.

Report your findings to the NCSC-FI

The NCSC-FI asks organisations to report any observed exploitation of the vulnerabilities, intrusions and suspected attack attempts. These reports help us build situational awareness of ongoing threat activity in Finland and protect other organisations.

You can report information security incidents to the NCSC-FI through the usual reporting channels.

• Report an information security incident

Vulnerable versions

The vulnerability affects the following products:

• NetScaler ADC and NetScaler Gateway 14.1 versions earlier than 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 versions earlier than 13.1-64.23
• NetScaler ADC 14.1-FIPS versions earlier than 14.1-73.37 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP versions earlier than 13.1-37.279

Patched versions

The fixes are included in the following versions or later:

• NetScaler ADC and NetScaler Gateway 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1-64.23
• NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279

• For more information, see vendor's bulletin. Ulkoinen verkkopalvelu.
• Information in Finnish