Nightpatch: NetScaler® Gateway upgrades that run in your window, after you approve
Nightpatch watches NetScaler builds and CVEs, then runs HA-aware upgrades you approve: secondary, failover, primary, post-checks, rollback, full audit log.
Change plan NP-0142
gw-ha-01: NetScaler HA pair upgrade
Reason: CVE-2026-88779 (CISA KEV), CVE-2026-107406
Window: Sat 22:00 to 02:00, rollback armed
- T0
Preserve evidence
Config snapshot and techsupport bundle, before anything changes
- T1
Full backup, copied off the box
create system backup -level full
- T2
Upgrade the secondary node
gw-b: 14.1-73.37 to 14.1-73.46
- T2
Fail over, then run health gates
HA sync, vservers UP, test logon
- T2
Upgrade the former primary
gw-a, only if every gate is green
- T1
Post-checks and evidence pack
Session kills only if the bulletin asks
Needs a Change Approver and a second approver
dry-run: 7/7 pre-checks passed
Two emergency builds in eight days
On September 27, 2026, Citrix fixed CVE-2026-88771 and CVE-2026-88772 in 14.1-73.37 and 13.1-64.23. CISA added both to its exploited list the same day, with a September 30 deadline.
By October 2, attackers were crashing appliances already patched to that build. The October 3 fix for CVE-2026-88779 needed 14.1-73.41 or 13.1-64.28, and on October 8 CTX697191 moved the safe build again, to 14.1-73.46 and 13.1-64.29.
Sources: CTX697096, CTX697174, CTX697191, CISA KEV catalog, BleepingComputer on CVE-2026-88779
Latest exploited NetScaler CVEs
Patching is necessary, not sufficient
In 2023, Fox-IT found web shells on 1,952 NetScaler appliances, and most of them had already been patched. A new build does not remove a backdoor. For KEV entries flagged for forensic triage, CISA's BOD 26-04 now asks agencies to preserve evidence first, patch second and write up the triage.
Sources: Fox-IT, CISA BOD 26-04 implementation guidance
The sequence, every time
The same order an experienced engineer follows, written down, enforced, and logged.
Before the window
- 1
Watch
Vendor bulletins and the CISA KEV list, matched to each appliance's build, FIPS train and configuration.
- 2
Plan
A typed plan per HA pair, with every pre-check run as a dry-run and the result shown.
- 3
Approve
A Change Approver signs the plan. Internet-facing gateways can require a second approver.
In the window
- 4
Preserve evidence
Configuration snapshot and a techsupport bundle before anything changes.
- 5
Back up
A full system backup, copied off the appliance.
- 6
Upgrade the secondary
With the firmware image you downloaded, checksum verified.
- 7
Fail over and gate
HA sync, virtual server state and a test logon. Any red gate stops the run.
- 8
Upgrade the other node
Only when every gate is green.
- 9
Post-patch actions
Session kills and configuration changes only where the bulletin calls for them, after every node runs the fixed build.
After
- 10
Roll back if needed
A failed gate fails back to the node still on the old build, and the plan halts.
- 11
Evidence pack
What ran, who approved it, before and after state, all in the hash-chained audit log.
The pre-checks that stop a bad night
These are the failures that turn a 30-minute upgrade into an outage. Nightpatch checks each one before it asks you to approve.
Licensing
On 14.1-66.x and later, an appliance still on file-based licensing blocks the upgrade. Every current 14.1 fixed build is past that line.
Disk space
The upgrade needs about 7 GB free on /var for the bundle, extraction and install.
HA state
Both nodes UP and in sync, with neither node forced to stay primary or secondary, or the failover step fails.
Saved configuration
Unsaved changes abort the built-in pre-checks, so the plan saves and diffs the running configuration first.
You download the firmware. We never host it.
NetScaler images require your own entitled Citrix account, and the licence terms forbid redistribution. You stage the image; Nightpatch verifies it and installs it. Only documented interfaces are used: the NITRO API, plus the documented CLI where NITRO has no equivalent.
Where Nightpatch is today
- Emergency Gateway Upgrades are assisted: we run Nightpatch with you on a call, and you approve each step.
- Unattended runs in your change window are switched on per customer, after supervised upgrades have completed cleanly.
- We are scheduling supervised upgrades through December 11, 2026, ahead of year-end change freezes.
Two ways to buy
Start with one assisted upgrade, or cover every appliance all year.
Emergency Gateway Upgrade (assisted)
$1,500 first HA pair
$750 for each additional pair
- Bulletin to patched in a window you choose
- Pre-checks, configuration and backup capture
- HA-aware upgrade: secondary first, failover, then primary
- Post-checks and an IoC triage checklist
- You approve every step on a call; you supply the firmware
Design partners: $750 per pair
Nightpatch
$1,200 per NetScaler instance per year
$2,400 per HA pair per year. Minimum $2,400 per year. Included in Operator for up to 4 instances.
- Continuous build and CVE watch against vendor bulletins and CISA KEV
- Staged, approval-gated upgrades: secondary, failover, primary
- Health gates and rollback on failed post-checks
- Hash-chained audit trail and an evidence pack per run
- Unlimited scheduled and emergency runs
Design partners: 50% off year 1
Questions
Do you host or download NetScaler firmware for us?
No. You download the image with your own Citrix account and stage it. Nightpatch verifies and installs it. We never host, cache or redistribute firmware.
Does it handle FIPS and NDcPP appliances?
Yes. FIPS and NDcPP trains have their own fixed builds, for example 13.1-37.283 FIPS, and Nightpatch tracks them separately from the standard trains.
What happens if a health gate fails halfway?
The run stops. Nightpatch fails back to the node that is still on the old build, halts the plan, and records every step in the audit log. Nothing else runs until a person decides.
Will it kill user sessions?
Only when the vendor bulletin calls for it, only after every node in the pair runs the fixed build, and only as an approved step in the plan.
Can it run during a change freeze?
It never runs outside the change window you set. A break-glass run needs a second approver and is flagged in the audit log.
Find out where your gateways stand tonight
The free checker shows which exploited CVEs affect your build and which build fixes them. It runs in your browser and never touches your appliance.