CRITICAL: Citrix NetScaler Hit by Two Unpatched RCE Zero-Days

If you run NetScaler at the edge of your network, this was not the weekend you were hoping for. Security firm watchTowr said on September 26 that two new remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway are being exploited in the wild as zero-days. There is no patch. There is no CVE. There is no formal Citrix advisory, no published workaround, and no public set of indicators of compromise. What there is, according to watchTowr, is "two vulnerabilities, both remote code execution, both unpatched, exploited before any fix existed, discovered during forensic investigations."

That last part is the one that should keep you up. These bugs were not found by a researcher poking at a lab box. They were found by incident responders cleaning up after real intrusions, which means somebody has already been using them against production appliances for an unknown stretch of time.

How This Surfaced

The first public hint came on September 25, when a post on the r/Citrix subreddit described a pre-notification reportedly sent by the Dutch National Cyber Security Centre (NCSC-NL) about unpatched NetScaler flaws. Administrators in the thread described the issue as remote code execution "with little effort," and some said they were pulling their internet-facing appliances offline rather than wait. A day later watchTowr went on the record, saying it had "verified the reports with authoritative sources" and confirming that both flaws had been exploited before any fix existed.

As of Sunday, September 27, neither Citrix nor NCSC-NL has published a formal bulletin. Reporting from The Hacker News and others indicates Citrix plans to ship fixes and communications early in the week of September 28. Until then, defenders are working from secondhand warnings and a vendor that has not said anything publicly, which is roughly the security equivalent of a smoke alarm going off in a building with no fire exits marked.

What We Know About the Flaws

The honest answer is not much, and anyone claiming precise technical detail right now is guessing. No CVE identifiers have been assigned, so there is no CVSS score to quote. The affected builds have not been named. What has been reported consistently across sources is that both bugs allow remote code execution on NetScaler ADC and NetScaler Gateway, that both were exploited as zero-days, and that no public proof of concept exists yet. I am treating this as critical anyway, and so should you. Unauthenticated or low-effort code execution on an internet-facing gateway lands at the top of the scale almost every time, and "actively exploited with no patch" is about as bad as the label gets.

It is also important to separate this from the NetScaler bug you were probably already dealing with. watchTowr was explicit that these are different from CVE-2026-19490, the authentication bypass Citrix patched on August 19. That flaw has been exploited since early September and landed in CISA's Known Exploited Vulnerabilities catalog on September 9. If you patched for CVE-2026-19490 and assumed you were done with NetScaler for the quarter, I have bad news. Being current on the August fix does not protect you from these new bugs.

There is one more wrinkle for anyone running older trains. NetScaler 13.1 reached End of Maintenance on September 15. Whether 13.1 builds are affected by the new flaws is not yet public, but if you are still on that branch, this is a very pointed reminder that the clock on your upgrade plan has run out.

Why NetScaler Keeps Ending Up Here

None of this is surprising if you have been in the field for the last few years. NetScaler sits exactly where attackers want to be. It handles VPN and remote access, it load balances critical applications, and it brokers user authentication, which means it touches session tokens, credentials, and internal network paths all at once. Compromise the gateway and you are standing on the threshold of the whole environment with a perfectly legitimate looking position.

We saw this movie with CitrixBleed in late 2023, when session hijacking against NetScaler fed ransomware crews for months. We saw it again with the string of 2025 memory disclosure and code execution bugs. Edge devices from Citrix, Fortinet, Ivanti, Cisco, and Palo Alto Networks have become the preferred front door for both ransomware affiliates and state-backed operators, precisely because they are internet facing, hard to monitor with endpoint tooling, and patched on a schedule that rarely keeps up with the people exploiting them.

Exploitation in the Wild

No victims have been named and no indicators have been published, so there is no clean way to scan your logs for a known bad IP and call it a day. The key fact is that the flaws were uncovered during forensic investigations, which tells us exploitation has been successful against real targets. It also tells us the attackers had a head start measured in days or weeks, not hours.

That shapes the entire response. As watchTowr and others have pointed out, because these bugs were exploited before any patch existed, shutting down or patching an appliance will not evict an attacker who is already inside it. Patching closes the door. It does not tell you who walked through it last Tuesday. Historically, NetScaler intrusions have involved web shells dropped on the appliance, harvested session tokens, and stolen credentials for service accounts tied to LDAP and Active Directory. Every one of those survives a firmware update if you do not go looking for it.

What to Do Right Now

Start with an honest exposure decision. If a NetScaler Gateway or ADC management interface is reachable from the internet, you need to decide today whether it stays online, gets restricted, or gets shut down until Citrix ships fixes. Some organizations have already chosen shutdown. That is a defensible call for anyone who can survive a few days without remote access, and it is not an overreaction given what we know.

If you cannot take the appliance offline, shrink the attack surface as far as the business will tolerate. Restrict inbound access to known employee or partner IP ranges, apply geographic blocking where it makes sense, and disable services you do not need. Several administrators have suggested disabling DTLS as an interim step, and some reporting recommends tightening any web application firewall in front of the appliance to its strictest mode. To be clear, none of these measures have been validated by Citrix, and nobody outside the vendor and a handful of responders knows which component is actually vulnerable. Treat them as risk reduction, not a fix.

Next, go hunting as if you have already been hit. The NCSC-NL guidance published for earlier NetScaler incidents in 2025 remains the best playbook available. Preserve VPX snapshots and logs before you change anything, isolate any appliance that looks suspicious, and run the NCSC-NL check scripts published on GitHub. Look for unexpected files in web-accessible directories, unfamiliar processes, and anything odd in the crash dump folder at /var/core and the logs under /var/nslog. Unexplained core dumps on a NetScaler are worth a very close look, because memory corruption exploits have a habit of crashing things when they misfire. On the SIEM side, review authentication activity that originated from the gateway, especially new sessions for privileged accounts, logins at strange hours, and lateral movement from the appliance's internal addresses.

If anything looks off, move to full credential hygiene. Rotate every service account password the appliance uses, including LDAP bind accounts. Revoke and reissue certificates and private keys stored on the device. Kill active sessions so any stolen tokens die with them. This is tedious work, and it is also the only part of the response that actually removes an attacker who already has what they came for.

Finally, prepare now for the patch drop. Citrix is expected to release fixes early this week, and the gap between a NetScaler patch going public and mass exploitation of the diff has historically been measured in hours. Stage your change windows, confirm you have console access and working backups, and plan to patch the same day the fix lands. Once CVE numbers and CISA KEV entries appear, federal agencies will get a hard deadline, and everyone else should behave as if they got one too.

The Bigger Picture

The frustrating part of this story is the information vacuum. Administrators learned about actively exploited flaws in their perimeter devices from a Reddit post and a security vendor's disclosure, not from the company that sells the product. Maybe Citrix has good reasons to hold back until fixes are ready. But when exploitation is already happening and customers are unplugging hardware on rumor, silence is not a neutral choice. It pushes defenders into guessing, and guessing is not a security strategy.

The lesson for everyone else is the same one we keep relearning. Edge devices need the same monitoring, logging, and incident response planning you give to domain controllers, because to an attacker they are just as valuable. If your plan for a NetScaler zero-day was "wait for the patch," you now know how that plan performs in practice.

MSP Angle

Clients running NetScaler, or any VPN appliance, need an edge exposure review and an assume-breach compromise assessment this week, and that is billable work you can scope today. Package it with ongoing perimeter log monitoring and a documented emergency patch SLA so the next zero-day is a managed process instead of a weekend fire drill.