No

If you are using Citrix Workspace App on your personal workstation and are launching an application (Outlook, Adobe, Excel, Internet Explorer, etc) then the only activity that can be monitored is what you do within that application.

If you leave Citrix open in the background or minimized, your employer cannot see what you do on your local browser, Steam, apps, etc.

If you launch a web browser in Citrix and use it to browse on the internet then yes, your employer can see your activities because you are remotely connected to their browser.

If you take your work computer home and use it to access Citrix your employer may have monitoring software installed and you should treat it as if you were at work.

TL;DR

Your employer cannot see what you do on your workstation with local apps.

Your employer can see what you are doing in your Citrix apps.

Be smart about what you're doing though. There is no reason you need NSFW material tabbed up and running while you're doing your job.

Does anyone know what is going on with Netscaler? We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately.

Nothing on the Citrix website or any of my usual tech news sites. One of my regular tech forums has a sysadmin section and multiple other sysadmins have shut theirs down to with no extra info

EDIT: apparently there's 2 new CVE's that allow for remote code execution pretty easily. More info and a possible software update after the weekend.

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

I opened a ticket with Citrix support and they seem to indicate a fix is being worked on right now.

Basically we were seeing random reboots of multiple instances and saw pitboss was rebooting these due to nsaaad crashing too many times.

Winding down and heading towards retirement. One thing I don't believe I'm going to miss is the perception that anytime there's an application or any problem no one knows why it happened, it's blamed on Citrix. Anyone else frustrated with this?

Two unpatched zero-days are being actively exploited in the wild. I've seen some companies are shutting their appliances down completely rather than wait.

If you can't take yours offline, lock down management access, watch your logs for anything weird, and plan for a compromise assessment once the fix lands.

Anyone else pulling the plug this weekend? How are you handling remote access in the meantime?

<Application> is running slow or freezing. Oh it runs on Citrix? IT’S A CITRIX PROBLEM!!

Users can’t update data in a database due to SQL connection errors. Oh it runs on Citrix? IT’S A CITRIX PROBLEM!!

User faces login issues on certain website or its dog slow when they login. Oh they’re launching it through Citrix? IT’S A CITRIX PROBLEM!!

No matter what it is, if it’s hosted on a VDA, it’s always automatically assumed Citrix is causing it. 🙄

Even when I show lack of log entries, that all infrastructure is up and running, that all VDAs are healthy and not overloaded and are balanced, that literally NOTHING indicates it’s a Citrix issue, it’s still thrown at me because Citrix is so easy to blame for all tech problems.

So I spend a week with Citrix Support just to prove YET AGAIN that Citrix is not the problem here. 99% of the time it’s the application itself, or the firewall, or the user’s home internet, or the SQL server itself crapped the bed and it becomes like pulling teeth to get it off my ticket queue and get people to understand and accept it’s NOT CITRIX causing the problem!!

Citrix is such a common scapegoat for work people don’t want to deal with, so they dump it on the Citrix guy to fix even when it has been proven to have zilch to do with Citrix!!

It’s the same story every renewal cycle. Citrix drops a massive price hike, IT leadership gets furious and threatens to find an alternative, and then... they just pay it. Citrix has this down to a science. They know that as much as we hate the bill, the fear of migration downtime and 'breaking the workflow' is way scarier to an IT director than budget pain. We’re basically being held hostage by our own fear of a messy transition . The only way to actually win this is to stop treating vendor evaluation like a 'once-every-three-years' panic project. If you aren’t running small pilot tests or documenting your dependencies during the off-season, you have zero leverage when the renewal hits. Real optionality isn’t a threat you make; it’s a setup you build over time so you can actually pull the trigger if you have to. I’m curious - if your boss walked in today and said 'we're off Citrix by Q3,' how much of that would be a technical nightmare vs. just a lack of documentation?

After a long journey, it is finally published.

I am happy to announce the publication of The Citrix Automation Handbook 2601.

Citrix platforms (e.g., Citrix Desktops as a Service, Citrix Virtual Apps and Desktops, Citrix Cloud, NetScaler span hybrid infrastructures, multiple operating systems, and a diverse set of configuration surfaces—from golden images and machine catalogs (MCS/PVS) to StoreFront, profiles, policies, and ADC traffic management.

Without a shared, codified approach, teams face configuration drift, slow and inconsistent deployments, brittle change processes, and avoidable downtime.

The Citrix Automation Handbook should be seen as a concise, practical technical handbook that discusses the frameworks, common language, patterns, and guardrails needed to scale Citrix reliably through Automation and Infrastructure as Code (IaC).

We provide examples and code snippets from the field and the lab, along with insights into strategies and best practices.

You should now find all relevant information and code examples for using Automation and Infrastructure-as-Code in one comprehensive handbook.

https://community.citrix.com/tech-zone/automation/automation-handbook-2601/

Further to the post (https://www.reddit.com/r/Citrix/comments/1ww3ess/security_update_guidance_for_netscaler_saml/) made on Friday, we've now updated this with a support article.

A vulnerability has been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779

==============

Solution from Citrix: https://support.citrix.com/article/CTX279897

==============

Original post:

Hello!

Two hours ago windows defender deletes BrokerService.exe (Citrix Broker Service) and HighAvailabilityService.exe (Service for high availability). We are on 7.15 CU4.

The services disapear from the services.msc. Luckly the second controller didn't update the virus definition and the broker service was still working.

Version of broken virus definition (deletes the files): 1.321.1319.0

Version of good virus definition: 1.321.1256.0

I disabled windows defender (you need to logon as local admin), copyed the two files from another controller to C:\Program Files\Citrix\Broker\Service.

The next step was to export the following keys from the working controller:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CitrixBrokerService HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CitrixHighAvailabilityService

and imported them on the broken controller. Because the keys was missing windows cann't start the services.

After a Reboot both services get started.

Now I need a beer, sadly I have none.

Sorry for my bad english, i did my best.

More here.

I mean NetScaler has already lost a lot of goodwill, and Citrix rarely ever market it well (people still think it's just a Gateway)...and then they do this kind if stuff. Honestly I don't understand it.

Traffic flowing through NetScalers has already dropped by HALF since 2023!

It sucks cause I like the features it offers, and it was really a steep learning curve (I am no expert in it btw)...but the company itself can't be bothered to run it well.

People say they're going the Broadcom way but I disagree. They're half assing even that.

TAM said they got layoffs going on at citrix and they are impacted. Surely tibco can’t make the customer experience any worse

Welcome to /r/Citrix !

First, some things to get out of the way -

1. /r/Citrix is not your company's help desk. Citrix can be implemented in a multitude of ways and without knowing what features, policies, products, etc your company has configured means we don't know what the exact issue or solution is going to be. If you have company-specific questions please direct those to your help desk.

2. Adding to the above statement, end users are limited in what they can change/troubleshoot. You cannot change policies or bypass security features your company has in place.

3. /r/Citrix is not here to help you bypass company policy or security. Working from home (WFH) and trying to hide a trip to Cancun? Not our issue and not something we can accurately answer.

Great, now that those few things are out of the way let's dive in.

New to using Citrix?

If you're using your personal device you'll need the following software to get started - Citrix Workspace App

If you're using your work/corporate device this client should be installed and managed by the company.

What does the Citrix Workspace App do?

The Citrix Workspace App (CWA) is a small client used to allow remote connectivity to applications or desktops hosted elsewhere. By default this agent will install an auto-update feature (Windows Service) which runs in the background and will keep the client updated automatically. Recommendation is to leave this on to ensure the latest security and feature enhancements are available on your machine.

Not comfortable installing a client?

Citrix also offers an HTML5 client that runs within a compatible browser. Please note that this is not enabled by default and your company may not have this feature enabled or allowed. There is also some features missing due to the nature of the client. The Feature Matrix is available here. You will need to contact your company's help desk if this is not currently enabled - please refer to the top bullets.

What information does the Citrix Workspace App collect/share with my company?

Honestly, not a whole lot. Your computer hostname, public IP address, CWA version are all visible to administrators. Recommend not naming your personal phone or computer MYBOSS_SUCKS as that can be seen.

There is also a Customer Experience Improvement Program (CEIP), more info here bundled with the CWA client to help Citrix with performance/fixes/etc with the product. It can be disabled in the settings if desired.

WORK IN PROGRESS MORE TO BE ADDED

(Suggestions welcome, please message the mod team)

Does this mean we are going to have monthly patching for Netscaler now and we will need to patch this Thursday, Nov 12?

Today, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. 

CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions. The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical. We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability. 

More information here: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/

After installing the September 2026 updates, some of our users get a black screen after log on. Manually starting explorer.exe, allows the session start successfully.

Pools using FSLogix as well as Citrix UPM Container are affected. Resetting the profile solves the issue. Seems like only older profiles run into it.

Has anyone else encountered this?

Windows 11 25H2 + VDA 2507 CU2

EDIT: This does not help, a simple logon script which starts explorer.exe works.

EDIT2 2026-09-12: Problem acknowledged by Citrix and MS CTX697101

EDIT3 2026-09-17: In my case this DOES work, I just had to make sure to run it before actual explorer.exe start (I did that by putting the script before userinit.exe)

EDIT4 2026-09-21: MS support just told me that they are still investigating and a real fix is to be expected in October or November. I told them that this is not acceptable.

EDIT5 2026-09-25: A KIR is available. Thanks to u/TheHolyOne1914

After few days, another CVE and new firmware released:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788&articleTitle=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_6543