Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Attack

On September 26, security firm watchTowr warned of two new zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances. Both allow remote code execution, both are unpatched, and both — according to the researchers — are already being exploited in the wild. Citrix has not confirmed the flaws or published a fix.

NetScaler ADC and Gateway sit at the edge of enterprise networks, handling VPN and remote access, load balancing, and user authentication. Compromising one is a route straight into the infrastructure.

What is known

These are not the authentication bypass CVE-2026-19490, which Citrix fixed on August 19 and CISA added to its Known Exploited Vulnerabilities catalog on September 9. The new flaws are distinct and remain unpatched. Citrix has not said whether the August builds 14.1-73.32 and 13.1-63.21, or any newer ones, are affected.

watchTowr's first post on X reacted to rumors of several NetScaler RCE flaws in the wild: "While details are scarce, the information is credible." A follow-up at 22:19 UTC gave more: both flaws were found during forensic investigations, exploitation began before any fix existed, and Citrix communications and patches are expected early in the week of September 28.

The firm published no evidence, named no victim, and did not say whose investigations found the exploitation. In August it had already shown that a NetScaler heap overflow Citrix patched in June could be turned into remote code execution.

Administrators pull the plug

The same day, shutdown advice surfaced on Reddit. An r/Citrix poster said their IT supplier's security team phoned to advise switching NetScalers off immediately, without explaining why. Others in the thread said their organizations had done the same. The source of the warning is not established.

With no bulletin, there is no vendor workaround and no published indicators of compromise. Because the exploitation, as watchTowr describes it, predates any fix, installing that fix will not tell an operator whether an attacker got in first.

What to do

In 2025, after a NetScaler zero-day was used against Dutch organizations, the Netherlands' National Cyber Security Center warned that updating alone does not remove the risk, since access gained before the patch persists. It advised running its check scripts, which look for signs of compromise but are not tied to one flaw and carry no guarantee (last updated September 2025).

Citrix's existing guidance for a suspected compromise: preserve evidence first (a VPX snapshot, logs, a technical support bundle, a packet-engine core dump), isolate the appliance, then change every service-account password and secret, reset users' passwords, and revoke certificates and keys. The management interface should never face the internet.

Which versions would even receive a fix is also open: NetScaler 13.1 reached End of Maintenance on September 15, and Citrix has not said whether it will be patched.

Source: The Hacker News