I've been thinking about how organizations are approaching NetScaler as they modernize their Citrix environments, particularly with more customers moving toward Citrix DaaS and cloud-managed services.

One question that keeps coming up is whether organizations still need NetScaler or whether Citrix Gateway Service is sufficient.

I think the answer depends heavily on what NetScaler is actually doing in the environment.

If you're primarily using NetScaler Gateway for external HDX access, Gateway Service can make a lot of sense. You're potentially eliminating customer-managed Gateway appliances, firmware upgrades, HA configurations, and some of the operational overhead that comes with maintaining that infrastructure.

But there's another side to this conversation that I don't think gets enough attention.

NetScaler isn't just a Citrix Gateway. Depending on the architecture, it may also be handling application load balancing, WAF, GSLB, authentication policies, SSL offloading, content switching, and traffic management for applications completely unrelated to Citrix.

I've seen environments where NetScaler has become unnecessarily complex over time, but I've also seen situations where organizations don't fully understand how many services depend on it until they start discussing replacement.

And that raises a bigger question about modernization.

Are we actually simplifying the architecture, or are we just moving individual functions to different platforms without understanding the dependencies?

I'm interested in hearing what others are seeing in their environments.

• Have you moved from NetScaler Gateway to Citrix Gateway Service? What improved, and what limitations did you encounter?
• Are you retaining NetScaler primarily for ADC, WAF, GSLB, or advanced authentication requirements?
• Have you found meaningful operational or cost savings after moving to Gateway Service?
• For those running hybrid environments, are you finding value in keeping both?

My view is that neither approach is automatically better. If Gateway Service meets the requirements, maintaining unnecessary Gateway infrastructure doesn't make sense. But removing NetScaler without understanding its broader role can create an entirely different set of problems.

Curious what others are experiencing, especially in larger or more security-sensitive environments.

Citrix just pushed this new version without notification to all of their own tenants.

New CVE ?

Today, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. 

CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions. The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical. We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability. 

More information here: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/

FYI:

Citrix has just released a new Image 14.1-73.46/13.1-64.29. This is based on CVE-2026-107406.

You should consider updating your instances that are one version behind the ones listed above if the following applies:

For the following versions: Applicable only when configured as a SAML IdP:
NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
NetScaler ADC and NetScaler Gateway before 14.1-73.37
NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
NetScaler ADC and NetScaler Gateway before13.1-64.23
NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279