# Agencies Patch Exposed NetScaler Systems

Citrix reported active exploitation of NetScaler vulnerabilities, including a flaw enabling unauthenticated command execution, and issued software updates. Cloudflare released an emergency WAF rule on October 1, 2026. Agencies and government contractors using exposed NetScaler instances should identify affected systems, apply the updates, investigate for compromise, and verify that access policies and origin restrictions cannot be bypassed. The signal describes defensive actions, not a solicitation, award, or contract opportunity.

- Organizations should inventory internet-exposed NetScaler deployments and prioritize patching, compromise checks, and review of access controls.
- Contractors supporting agency networks may need to coordinate remediation and verification with customers; the reported active exploitation makes this relevant to operational security and service continuity.
- Cloudflare’s emergency WAF rule is a mitigation described in the source, not a substitute for applying Citrix’s software updates.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 19, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Citrix (NetScaler software provider)
- Cloudflare (WAF provider)
- Mandiant ()

### Sources
- [There's always a patient zero: Defending the NetScaler front door before the patch | Cloudflare Blog](https://blog.cloudflare.com/protect-your-netscaler-gateway) - Cloudflare Blog