Citrix NetScaler Gateway — Cyber Threats, Attacks & Incidents

Overview

Citrix NetScaler ADC and Gateway comprise Citrix's application delivery controller and secure remote-access platform, used by many enterprises for load balancing, application delivery, and VPN-style remote access. Recent reporting highlights a cross-site scripting vulnerability fixed by an update, underscoring the platform's exposure surface, and indicates that Citrix and Cisco 0-day exploits have been associated with advanced threat activity and weaponization.

Related Threat Clusters

• Advanced Threat Actor Exploits Cisco and Citrix Zero-Day Vulnerabilities

  An advanced persistent threat actor exploited zero-day vulnerabilities in Cisco Identity Service Engine and Citrix NetScaler products. The attacks utilized custom malware and were detected by Amazon's MadPot honeypot…

  8 articles · Updated November 12, 2025
• FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

  A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of…

  100 articles · Updated November 15, 2025
• Citrix NetScaler Vulnerabilities Enable DoS and Memory Disclosure Attacks

  Citrix disclosed six high-severity vulnerabilities in NetScaler ADC and Gateway appliances, including CVE-2026-8451, which allows unauthenticated memory disclosure when configured as a SAML identity provider. Other…

  45 articles · Updated July 1, 2026
• Urgent Mitigation Needed for Multiple Cyber Vulnerabilities in UK Organizations

  The NCSC has issued an urgent advisory for UK organizations to address critical vulnerabilities affecting F5 BIG-IP Access Policy Manager, Citrix NetScaler ADC, and Citrix NetScaler Gateway. These vulnerabilities…

  2 articles · Updated April 15, 2026
• APT Exploits Zero-Day Vulnerabilities in Cisco and Citrix Systems

  An advanced persistent threat (APT) group exploited zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix systems, specifically CVE-2025-5777 and CVE-2025-20337. The attacks were detected by…

  16 articles · Updated November 18, 2025
• Citrix NetScaler ADC and Gateway XSS Vulnerability Disclosed

  A cross-site scripting (XSS) vulnerability has been identified in Citrix's NetScaler ADC and Gateway products, tracked as CVE-2025-12101. This flaw allows attackers to inject malicious scripts into web pages,…

  2 articles · Updated November 13, 2025
• Citrix NetScaler ADC and Gateway XSS Vulnerability Disclosed

  A cross-site scripting (XSS) vulnerability has been identified in Citrix's NetScaler ADC and Gateway products, tracked as CVE-2025-12101. This flaw allows attackers to inject malicious scripts into web pages,…

  4 articles · Updated November 13, 2025

Recent Intelligence Reports

• Multiple Citrix NetScaler ADC and Gateway Vulnerabilities Enables DoS and Memory Overflow Attacks — Cybersecuritynews · July 1, 2026
• Attackers can disable Citrix NetScaler ADC and NetScaler Gateway — Heise.De · July 1, 2026
• Log4Shell exploit — www.ncsc.gov.uk · April 15, 2026
• Ivanti Connect Secure vulnerabilities — www.ncsc.gov.uk · April 15, 2026
• Citrix Netscaler ADC and Gateway: Update closes cross-site scripting gap — Heise.De · November 13, 2025
• Zero — Csoonline · November 13, 2025
• Amazon: Cisco, Citrix 0-days indicate 'advanced' attacker — Theregister · November 12, 2025
• Amazon: Cisco, Citrix 0-days indicate 'advanced' attacker — Theregister · November 12, 2025

Related Entities