The National Cyber Security Centre has issued an urgent warning for UK organisations to take immediate action to mitigate two recently disclosed vulnerabilities, CVE-2026-3055 and CVE-2026-4368, that affect Citrix NetScaler ADC and Citrix NetScaler Gateway. The emergency advisory represents one of the most significant security alerts issued by the government agency in recent weeks, highlighting the serious threat these flaws pose to British businesses and public sector organizations relying on Citrix infrastructure for their network operations.
Critical Infrastructure at Risk
The vulnerabilities affect Citrix NetScaler ADC and Gateway products, which are widely deployed across UK enterprises as application delivery controllers and secure remote access solutions. These systems sit at the edge of corporate networks, handling sensitive traffic and authentication processes that make them particularly attractive targets for cyber criminals and state-sponsored threat actors. When network gateway systems are compromised, attackers can gain access to internal systems, intercept communications, and establish persistent footholds within organizational networks that may go undetected for extended periods.
NCSC Calls for Swift Action
The NCSC warning comes amid growing concerns about the exploitation of network infrastructure vulnerabilities by sophisticated threat groups. UK organisations are being encouraged to take immediate action to mitigate the recently disclosed vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Security experts warn that once vulnerabilities in widely used products like Citrix NetScaler become public knowledge, the window for patching systems before exploitation attempts begin shrinks dramatically. Criminal groups and advanced persistent threat actors often race to identify and exploit unpatched systems within hours or days of vulnerability disclosures.
Broader Security Landscape Concerns
The Citrix alert is part of a wider pattern of critical infrastructure warnings from the NCSC. The NCSC is encouraging UK organisations to mitigate an unauthenticated remote code execution vulnerability affecting F5 BIG-IP Access Policy Manager. These concurrent advisories suggest that network edge devices and application delivery systems have become priority targets for malicious actors seeking to compromise British organizations. The convergence of multiple critical vulnerabilities affecting similar classes of infrastructure equipment indicates a coordinated effort by threat actors to identify and exploit weaknesses in enterprise perimeter defenses.
International Threat Activity
The urgency around securing network infrastructure comes as the NCSC continues to track sophisticated campaigns by state-sponsored groups. Russian cyber actor APT28 exploit vulnerable routers to hijack DNS, enabling adversary‑in‑the‑middle attacks and theft of passwords and authentication tokens. This demonstrates how compromised network devices can serve as launching points for broader attacks that steal credentials and intercept sensitive communications. The techniques employed by APT28 show how infrastructure vulnerabilities can be chained together to create devastating attack scenarios that compromise entire organizational ecosystems.
What Organizations Must Do
Organizations running affected Citrix systems need to prioritize patching these vulnerabilities immediately. This includes conducting thorough inventories of all Citrix NetScaler ADC and Gateway deployments, applying the latest security updates released by Citrix, and implementing additional monitoring to detect any signs of compromise or exploitation attempts. IT security teams should also review access logs and authentication records to identify any suspicious activity that may indicate systems were compromised before patches could be applied. Beyond immediate patching, organizations should evaluate their vulnerability management processes to ensure critical infrastructure updates can be deployed rapidly when new threats emerge.
Growing Pressure on UK Cyber Defenses
The multiple concurrent advisories from the NCSC reflect the challenging security environment facing UK organizations. In response to the evolving events in the Middle East, the NCSC is advising that UK organisations review their cyber security posture. This broader advisory suggests that geopolitical tensions may be driving increased cyber threat activity targeting British entities. Organizations need to maintain heightened vigilance and ensure their security controls are properly configured and actively monitored. The combination of critical vulnerabilities in widely deployed systems and elevated geopolitical tensions creates a perfect storm that demands immediate attention from security leaders across all sectors of the UK economy. Companies that delay patching or fail to take these warnings seriously risk becoming the next victim in what has become an increasingly aggressive threat landscape where network infrastructure has emerged as a primary target for sophisticated attackers.