NetScaler Needs More Than Another Patch

Fri, 02 Oct 2026 08:00:00 +0200

Another critical NetScaler advisory. Another emergency upgrade. Another security team trying to establish whether the box protecting access to the network has already let somebody in.

The routine is becoming far too familiar. We buy an appliance to handle hostile traffic, give it certificates, authentication duties and access to internal services, then organise an emergency every time it mishandles the traffic it was bought to handle.

My patience with that arrangement has run out.

NetScaler is worth examining because it brings the problem into focus: a substantial security role, a long vulnerability history, and an installed base with plenty of reasons to keep renewing. The same procurement questions belong in front of every edge vendor.

There is one very recent development. On 1 October 2026, Citrix released a Linux-based NetScaler VPX 15.1 as a Tech Preview, with changes to the platform and its hardening. On paper it looks like the right direction. But it is a preview and a feature list, not yet a product customers run, and the question is how much it improves the security boundaries they actually depend on. We need to see the shipping product before giving it credit.

I want evidence that the next serious bug has somewhere to stop.

Edge Devices on Martin's Blog

NetScaler Needs More Than Another Patch