ACSC sounds critical Citrix NetScaler alarm as exploitation reports mount

Australian organisations running Citrix NetScaler gear have another urgent patching job on their hands.

GovTech Review reported on Monday, 28 September 2026, that ASD’s Australian Cyber Security Centre had issued a critical alert for eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products.

According to that secondary report, the ACSC understands at least two of the vulnerabilities, listed as CVE-2026-88771 and CVE-2026-8872, had been under active exploitation globally before a patch became available. The report said the ACSC had not received reports of confirmed exploitation in Australia.

The same account described CVE-2026-88771 as a remote code execution vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. It said all configurations of Citrix NetScaler ADC and NetScaler Gateway were affected by that CVE, while the other seven issues depended on specific configurations being present.

Primary vendor material supplied by Citrix owner Cloud Software Group separately lists a critical NetScaler ADC and NetScaler Gateway security bulletin for CVE-2026-19489 and CVE-2026-19490. That bulletin says multiple vulnerabilities have been discovered in NetScaler ADC, formerly Citrix ADC, and NetScaler Gateway, formerly Citrix Gateway.

Cloud Software Group says supported affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, NetScaler ADC FIPS before 14.1-73.32 FIPS, and NetScaler ADC FIPS and NDcPP before 13.1-37.277. It also says Secure Private Access Hybrid deployments using NetScaler instances are affected.

The vendor describes CVE-2026-19489 as a memory overflow vulnerability that can lead to unpredictable behaviour or denial of service, with a CVSS v4.0 base score of 8.8. It says the precondition is SIP ALG being enabled on a Large Scale NAT group configuration.

CVE-2026-19490 is described in the vendor bulletin as an authentication bypass using an alternate path, with a CVSS v4.0 base score of 9.3. The affected conditions vary by version and include appliances configured as a Gateway or AAA virtual server, with SAML action requirements for some builds.

Cloud Software Group says the bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway. It says Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by Cloud Software Group with the required software updates.

The company strongly urges affected customers to install relevant updated versions as soon as possible.

A separate secondary vulnerability-tracking page from Previdian claims CVE-2026-19490 has been actively exploited, with exploitation attempts first observed in its honeypot sensors on 3 September 2026 and last observed on 22 September 2026. It also claims the flaw is listed in CISA’s Known Exploited Vulnerabilities catalogue. Those claims are not primary vendor statements.

The ACSC advice, as reported by GovTech Review, is straightforward: review the vendor details, install the security update, check which CVE preconditions may apply, and review device logs for suspicious activity consistent with the relevant attack paths.

Organisations that suspect impact or need assistance can contact the ACSC through 1300 CYBER1.