No, NetScaler 13.1 Did Not Die on September 15 — That Was End of Maintenance, and End of Life Is a Year Later

By Scott Bissett · Published: September 4, 2026 · EOL Watch — deadline coverage · Every date verified against NetScaler's release-cycle article and product matrix — methodology

A round of write-ups in early September 2026 said NetScaler ADC firmware 13.1 “reaches end of life on September 15, 2026.” It did not. The vendor's own release-cycle article, CTX241500, puts it in one sentence: “13.1 will reach EOM on 15-Sep-26 and EOL on 15-Sep-27.” September 15 is End of Maintenance. End of Life for the 13.1 line is September 15, 2027, a full year later. Our NetScaler ADC lifecycle page has carried both dates, labelled correctly, since the product was added.

The distinction is not pedantry. It changed what a team had to do in the eleven days before September 15, and it was being flattened in exactly the direction that causes bad decisions: the “dies on the 15th” version sends people into emergency upgrades of the one appliance class that has been at the centre of every major exploitation wave since 2019, on a timeline that invites mistakes.

What actually changed on September 15, 2026: 13.1 left its maintenance phase. Under NetScaler's published model the final year of a release line is “technical support only until the End of Life (EOL) date.” Plan on the basis that no further maintenance builds are promised for 13.1 after that date, and read any fix that does ship as a courtesy, not a commitment. Full end of life — the point at which the line is unsupported outright — is September 15, 2027.

Update, added the day CISA listed the flaw: an exploited authentication bypass whose 13.1 fix lands in the line's last maintenance week. CISA added CVE-2026-19490, an authentication bypass in NetScaler ADC and NetScaler Gateway (CVSS 4.0 base score 9.3), to its Known Exploited Vulnerabilities catalog on September 9, 2026, with a federal remediation deadline three days later. Citrix's bulletin CTX696939 gives the affected versions as 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21 (13.1 FIPS and NDcPP before 13.1-37.277), and the fixed releases as 14.1-73.32 and 13.1-63.21 or later. The precondition is an appliance configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or an AAA virtual server; from 13.1-61.28 and 14.1-43.56 up, only when a SAML action is also configured. The timing is why this page exists: 13.1's maintenance phase ended on September 15, 2026. A 13.1 appliance that was not on 13.1-63.21 by then was relying on a line in its technical-support-only year for its next security build, and 13.1-63.21 was that build.

Update for the three flaws CISA has listed since: 13.1 has kept receiving security builds after its maintenance phase ended. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a federal remediation deadline of September 30, 2026, and CVE-2026-88779 on October 4, 2026, with a deadline of October 7, 2026. Citrix's bulletin CTX697096 describes CVE-2026-88771 as remote code execution by an unauthenticated attacker through improper input validation, affecting every NetScaler ADC and NetScaler Gateway deployment including the default configuration (CVSS 4.0 base score 9.5), and CVE-2026-88772 as a memory overflow leading to remote code execution or denial of service where DTLS is enabled, which is the default on a VPN virtual server (9.5). The bulletin says exploits of both have been observed; it covers six further CVEs, and its fixed releases are 14.1-73.37 and 13.1-64.23 (13.1 FIPS and NDcPP 13.1-37.279). Bulletin CTX697174 describes CVE-2026-88779 as a memory overflow leading to denial of service on an appliance configured as a SAML service provider or SAML identity provider (CVSS 4.0 base score 8.7), fixed in 14.1-73.41 and 13.1-64.28 (13.1 FIPS and NDcPP 13.1-37.282). That bulletin does not itself report exploitation; the catalog entry is the evidence for it. Two things follow for a 13.1 estate. First, the build to be on is now 13.1-64.28 or later, which contains all three fixes. Second, both bulletins list 13.1 among the supported versions and both builds shipped after September 15, 2026, so fixes have continued into the technical-support-only year so far; NetScaler's lifecycle wording still does not promise the next one. Neither bulletin assesses the end-of-life lines 13.0 and 12.1: read that silence as no fix coming, not as not affected.

The 13.1 dates, from the vendor

Milestone	Date	What it means
13.1 general availability	September 15, 2021	Start of the feature phase
Maintenance phase	From Q3 2023	Maintenance releases only; CTX241500 extended this from two years to three when the seven-year model was introduced
End of Maintenance (EOM)	September 15, 2026	Maintenance phase ends; technical support only from here
End of Life (EOL)	September 15, 2027	Line unsupported; the product matrix notes optional extended support for eligible customers, arranged with the vendor

Two things make the confusion easy. First, NetScaler's older lines used a five-year model with the same two milestones, so people who remember “13.0 ended in July 2024” — which was its EOL, July 15, 2024 — assume the next September date is the same kind of ending. Second, and more concretely, a different product with the same version number really did end this year. The same CTX241500 article states that NetScaler Console on-premises 13.1 (the management product, formerly ADM) had its End of Maintenance moved from September 15, 2026 to April 15, 2026 and its End of Life moved from September 15, 2027 to April 15, 2026. Console 13.1 is genuinely finished. ADC firmware 13.1 is not. Put the two in the same search and the aggregator output writes itself.

Facing an end-of-life deadline?

Tell us which product and we’ll reply with vetted extended-support options and pricing guidance — free, no obligation. Vendors don’t pay for placement.

Why the extra year is not a reason to wait

Having a year does not mean spending it. NetScaler ADC and Gateway is the appliance behind CVE-2019-19781, behind CitrixBleed (CVE-2023-4966) and behind CitrixBleed 2 (CVE-2025-5777), all in CISA's Known Exploited Vulnerabilities catalog, and the pattern in every one of those waves was the same: the fix existed, and the appliances that were hit were the ones a version or two behind. A line in its technical-support-only year is, by the vendor's own model, the line least likely to receive the next fix quickly. That is the honest case for moving off 13.1 — not that it stopped working on the 15th. The current line is 14.1, released August 8, 2023, on the seven-year cycle: End of Maintenance August 8, 2029, End of Life August 8, 2030. And if anything in the estate is still on 13.0 (End of Life July 15, 2024) or 12.1 (May 30, 2023), that is the emergency, not 13.1.

For US federal agencies and anyone borrowing their playbook, the relevant line is CISA's BOD 26-02, which treats end-of-support edge devices as a category to be removed rather than risk-accepted. A NetScaler on 13.1 did not enter that category on September 15, 2026. It enters it on September 15, 2027. Our EOS Edge Device List tracks that status for NetScaler alongside the other firewall, VPN and ADC platforms, and it will flip on the correct date.

The 13.1 checklist

Confirm which product you are reading about. ADC/Gateway firmware 13.1: EOM September 15, 2026, EOL a year later. Console on-premises 13.1: already past both, since April 15, 2026. If a Console 13.1 is still running, that is the thing to fix this week.
Inventory the build, not just the line. Write down the exact 13.1 build on every appliance and HA pair, and check it against NetScaler's security bulletins for the 2025 and 2026 CVEs, starting with CTX696939: anything below 13.1-63.21 is exposed to CVE-2026-19490, and anything below 13.1-64.28 to one or more of CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779 (CTX697096, CTX697174). The build number decides exposure; the line decides support.
Schedule the 14.1 move inside the maintenance year, not at the end of it. The extended-support wording on the product matrix is a lifeline for eligible customers, not a plan. Treat 13.1's technical-support-only year as the migration window and aim to be done well before September 15, 2027.
Correct the ticket if someone opened one saying “EOL September 15.” Give it the vendor sentence and the right date. Urgency built on a wrong date evaporates when the date passes and nothing happens, and the estate is then harder to move a year later.

Frequently Asked Questions

Is NetScaler 13.1 end of life on September 15, 2026?

No. September 15, 2026 was End of Maintenance for NetScaler ADC firmware 13.1. End of Life is September 15, 2027. NetScaler's release-cycle article CTX241500 states: “13.1 will reach EOM on 15-Sep-26 and EOL on 15-Sep-27.”

What is the difference between End of Maintenance and End of Life for NetScaler?

End of Maintenance closes the maintenance-release phase of a firmware line; under NetScaler's published model the final year is technical support only until the End of Life date. End of Life is when the line is unsupported, with optional extended support noted on the product matrix for eligible customers.

Did anything NetScaler 13.1 actually end in 2026?

Yes, but not the ADC firmware. NetScaler Console on-premises 13.1, the management product formerly called ADM, had both its End of Maintenance and End of Life moved to April 15, 2026 per CTX241500. The two products share a version number and are easy to conflate.

Should we still move off 13.1 soon?

Yes. The technical-support-only year is the migration window, not a grace period. NetScaler ADC and Gateway has a long run of CISA Known Exploited Vulnerabilities entries, and appliances behind on fixes are the ones that get hit. The current line is 14.1, with End of Maintenance August 8, 2029 and End of Life August 8, 2030.

Where are the authoritative sources?

NetScaler's release-cycle article CTX241500 (support.citrix.com) and the Citrix product lifecycle matrix (citrix.com/support/product-lifecycle/product-matrix.html). The dates in this article were checked against those pages on 2026-09-04.

No, NetScaler 13.1 Did Not Die on September 15 — That Was End of Maintenance, and End of Life Is a Year Later

The 13.1 dates, from the vendor

Why the extra year is not a reason to wait

The 13.1 checklist

Frequently Asked Questions

Related Resources

The Monthly EOL Digest™