2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

Citrix has disclosed critical vulnerabilities in NetScaler ADC and NetScaler Gateway, including a memory overflow and an authentication bypass — two flaw classes that can enable remote code execution and unauthorised access without valid credentials. These products are widely deployed as internet-facing network gateways, making them high-value targets for threat actors who actively exploit Citrix vulnerabilities within days of disclosure. The authentication bypass is particularly dangerous because it allows attackers to circumvent security controls entirely, potentially exposing internal networks. Delayed patching of perimeter appliances in this threat category has historically led to ransomware deployment and data exfiltration at scale. Organisations must treat critical advisories on gateway infrastructure as emergency-priority remediation items.