Citrix Security Advisory AV26-645: Critical Vulnerabilities in NetScaler Products
On June 30, 2026, Citrix issued a security advisory detailing critical vulnerabilities affecting several versions of its NetScaler ADC and NetScaler Gateway products. The vulnerabilities, identified as CVE-2026-8451 and CVE-2026-8452, have been confirmed to be actively exploited in the wild, raising significant concerns for users and administrators.
The affected products include:
- NetScaler ADC and NetScaler Gateway – versions 14.1 before 14.1-72.61
- NetScaler ADC and NetScaler Gateway – versions 13.1 before 13.1-63.18
- NetScaler ADC FIPS – versions before 14.1-72.61 FIPS
- NetScaler ADC FIPS and NDcPP – versions before 13.1-37.272
Exploitation Status
Recent open-source reports indicate that both CVE-2026-8451 and CVE-2026-8452 are being exploited by threat actors. This active exploitation underscores the urgency for organizations to address these vulnerabilities promptly.
Recommended Actions
The Cyber Centre strongly advises users and administrators of the affected Citrix products to review the security advisory and apply the necessary updates without delay. Ensuring that systems are running the latest versions is critical to mitigating the risks associated with these vulnerabilities.
For further details and to access the advisory, please visit the Citrix security advisory page.
Follow Cyber Warriors Middle East for further cybersecurity resources, advisories and technical guidance.
