Reports that attackers are actively exploiting two previously unknown remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway should be treated as a serious warning for organizations operating these devices at the edge of their networks. Security firm watchTowr says the vulnerabilities were discovered during forensic investigations and had already been exploited before patches were available, making them zero-days in the strict sense. As of September 27, 2026, Citrix had not publicly disclosed the vulnerabilities, assigned CVE identifiers, identified affected versions, published mitigation guidance, or released fixes.

That absence of information creates an unusually difficult defensive situation. With a normal vulnerability disclosure, administrators can compare their appliance version against an affected-version list, install a fixed build, search for published indicators of compromise, and then assess whether exploitation occurred before patching. In this case, defenders currently do not know which NetScaler versions are vulnerable, which configuration exposes the attack surface, what network requests trigger exploitation, or what artifacts attackers leave behind. The only significant public information is watchTowr's assessment that two different RCE vulnerabilities exist, both remain unpatched, and both have been exploited in the wild. Citrix communications and patches are reportedly expected during the week beginning September 28.

The potential impact is particularly serious because NetScaler appliances are not ordinary application servers. NetScaler ADC and NetScaler Gateway frequently operate at the external boundary of enterprise networks, handling SSL VPN access, ICA proxying, authentication, application delivery, load balancing, and remote connectivity. Successful remote code execution against such an appliance could potentially provide an attacker with a privileged foothold at one of the most strategically useful locations in the network. From there, depending on configuration and privileges, attackers may be able to steal credentials, observe authentication flows, manipulate network traffic, establish persistence, pivot toward internal systems, or use the appliance as a staging point for further intrusion.

This is also why Internet-facing network appliances have become such valuable targets for both espionage groups and financially motivated attackers. Edge devices are exposed by design, often process authentication traffic, and typically sit in trusted network positions. At the same time, they may provide considerably less EDR visibility than Windows or Linux servers. An attacker who compromises an edge appliance can therefore gain both strategic network access and a comparatively quiet place from which to operate.

The newly reported vulnerabilities should not be confused with CVE-2026-19490, the NetScaler authentication-bypass vulnerability Citrix patched on August 19. That flaw affects appliances configured as Gateway or AAA virtual servers under specified conditions and was added to CISA's Known Exploited Vulnerabilities catalog earlier in September after exploitation attempts were observed. Citrix's fixed builds for that vulnerability include 14.1-73.32 and 13.1-63.21. watchTowr says the two newly reported RCE issues are separate vulnerabilities, and Citrix has not yet stated whether those August builds or newer versions remain vulnerable to the newly discovered flaws.

That distinction is extremely important for administrators. A NetScaler appliance that is fully updated against CVE-2026-19490 should not currently be assumed protected against these new RCE vulnerabilities. Conversely, because the affected-version range has not been published, organizations should also avoid assuming that one particular build is definitely vulnerable. Until Citrix provides authoritative information, the safest working assumption for externally accessible customer-managed NetScaler appliances is that exposure requires urgent assessment.

watchTowr has not published technical exploit details, identified victims, or released proof-of-concept code. It has also not disclosed whose forensic investigations uncovered the exploitation. That restraint is appropriate while no vendor patch exists, because publishing exploitation details for an unpatched edge-device RCE could immediately increase widespread abuse. However, the lack of technical detail also means defenders cannot yet construct reliable signatures around exploit requests or specific post-compromise artifacts.

Reports have emerged of organizations and security suppliers recommending that NetScaler appliances be isolated or even temporarily taken offline until more information becomes available. The Hacker News cites administrators who say security teams advised them to shut down NetScaler systems immediately, although the source of those recommendations has not been independently established. In a normal environment, powering down a VPN or application-delivery gateway would be a significant operational decision. In the presence of credible intelligence about an actively exploited, unpatched pre-authentication RCE, however, temporary unavailability may be preferable to allowing an unknown attacker direct code execution on the network perimeter.

Organizations unable to take NetScaler systems offline should at minimum reduce exposure aggressively. Management interfaces should never be exposed publicly, and administrative access should be limited to dedicated management networks or strongly controlled VPN paths. Unnecessary virtual servers, management services, and externally accessible functionality should be disabled where operationally possible. Firewall policy should restrict access to only the networks and services genuinely required, and organizations should carefully assess whether remote-access functionality must remain publicly reachable during the current uncertainty.

The potential for prior compromise is just as important as the present exposure. Because watchTowr says attackers exploited the vulnerabilities before fixes existed, installing a future Citrix patch will not establish that an appliance is clean. If an attacker gained access before remediation, they may have created additional users, modified configuration, deployed persistence, stolen credentials, introduced certificates or SSH keys, or established access through other internal systems. The eventual patch will close the original entry point, but it cannot automatically undo post-exploitation activity.

Citrix's existing incident-response guidance for suspected NetScaler compromise is therefore highly relevant. Citrix recommends preserving evidence before making major changes, including VPX snapshots where applicable, remote syslog data, NetScaler Console logs, support bundles, and packet-engine core dumps. The appliance should then be isolated from the network. Citrix also recommends changing service-account passwords and secrets stored on the device, resetting credentials of users who authenticated through it, and revoking certificates and private keys where compromise is suspected.

Those credential precautions deserve particular attention. NetScaler appliances may interact with Active Directory, LDAP, RADIUS, SAML identity providers, backend applications, certificate stores, service accounts, and VPN users. If an attacker achieves arbitrary code execution on the appliance, any credentials or cryptographic material available to that system may become exposed. Remediation therefore may require substantially more than rebuilding the appliance itself.

Organizations should also ensure that logs are being sent to external systems. Local logs on a compromised security appliance should never be treated as the only forensic record because an attacker with sufficient privileges may alter or delete them. Remote syslog, SIEM, firewall telemetry, authentication logs, and identity-provider records may preserve evidence that survives even if the appliance itself is tampered with.

Defenders should pay particular attention to unusual administrative sessions, configuration changes, new local users, modified startup configuration, unfamiliar files, unexplained outbound connections, unexpected certificate activity, and authentication events that do not correspond with normal user behavior. Because there are currently no vulnerability-specific indicators, broader behavioral hunting becomes considerably more important.

Another valuable source of evidence is authentication telemetry surrounding the Gateway. If an attacker used the compromised appliance to steal credentials, replay sessions, or manipulate authentication, identity systems may show anomalous logins even where the NetScaler itself provides little evidence. VPN users authenticating successfully from unfamiliar infrastructure, unusual MFA patterns, unexpected SAML activity, or service accounts being used outside their normal context should be investigated.

Organizations running virtual NetScaler appliances should preserve snapshots before rebuilding whenever possible, because forensic analysis may later become valuable once Citrix or researchers publish indicators. Physical appliances present a harder forensic problem, making centralized logging and configuration backups even more important.

The timing also creates an additional complication for customers running NetScaler 13.1, which reached End of Maintenance on September 15, 2026. Citrix had not clarified as of September 27 whether that branch would receive fixes for the new vulnerabilities. Organizations remaining on versions at or beyond maintenance deadlines should therefore prepare for the possibility that mitigation may require an urgent platform upgrade rather than a normal point release.

The reported zero-days also arrive after an unusually active year for NetScaler security. Citrix patched multiple serious vulnerabilities in 2026, including CVE-2026-8451 and CVE-2026-8452 in the summer and CVE-2026-19490 in August. watchTowr previously demonstrated that CVE-2026-8452, a memory corruption issue in NetScaler's SAML processing, could be developed into unauthenticated remote code execution under vulnerable configurations.

That history matters because it highlights the broader problem of memory-safety and authentication vulnerabilities appearing repeatedly in infrastructure that sits directly on the enterprise perimeter. Organizations should therefore consider NetScaler not merely as networking equipment that receives occasional firmware maintenance, but as a high-risk Internet-facing security asset requiring the same vulnerability-management urgency applied to firewalls, VPN gateways, identity systems, and externally accessible application platforms.

The most difficult question for defenders today is whether to keep an essential NetScaler appliance online while waiting for Citrix. There is no universal answer because operational requirements differ dramatically. A hospital, bank, government organization, or globally distributed enterprise may depend on NetScaler Gateway for remote access, while another organization may be able to redirect traffic or temporarily disable external access. The decision should therefore be based on the organization's exposure, business dependency, ability to isolate the appliance, availability of alternative access paths, and tolerance for the possibility that an unpatched RCE is being actively exploited.

However, the risk calculation should reflect an important asymmetry: temporary service disruption is reversible; a compromise of an Internet-facing authentication gateway may not be. If alternative infrastructure is available, moving services away from exposed NetScaler systems until Citrix publishes authoritative guidance may be a reasonable defensive measure.

The larger cybersecurity lesson is that zero-day exploitation of perimeter devices leaves defenders with very few comfortable options. There may be no patch, no CVE, no signature, and no reliable indicator. In those circumstances, security falls back to the fundamentals: reduce exposure, segment aggressively, preserve telemetry, control credentials, and be prepared to rebuild from trusted state.

The likely response sequence should therefore be:

identify every NetScaler appliance → determine Internet exposure → restrict or isolate where possible → preserve forensic evidence → monitor authentication and network activity → prepare for Citrix's emergency update → patch immediately when available → continue compromise assessment after patching.

The final step is essential. If watchTowr's report is correct, attackers already had a window in which no patch existed.

That means when Citrix releases the fix, the question should not simply be:

“Are we patched?”

It should also be:

“What happened to this appliance before the patch existed?”

For Internet-facing edge devices, a successful patch closes tomorrow's door. It does not prove nobody came through yesterday's.

Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one to be available. NetScaler ADC and

Source: Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation via The Hacker News — published 27 Sep 2026.