Active Exploitation of Two New Unpatched Zero-Day Vulnerabilities Discovered in Citrix NetScaler Appliances

Security researchers and enterprise IT departments are on high alert following reports of two new unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. These flaws, which reportedly allow for remote code execution (RCE), are being actively exploited in the wild, according to a disclosure from the security firm watchTowr on September 26, 2026. The revelation has sent shockwaves through the cybersecurity community, as these appliances serve as critical gatekeepers for corporate networks, handling everything from remote access and virtual private networks (VPNs) to sophisticated load balancing and user authentication.

As of Sunday morning, Citrix has not officially confirmed the existence of these specific flaws, nor has the company published a security bulletin or a technical fix. The lack of an official response from the vendor has left system administrators in a precarious position, forced to choose between maintaining essential network services and risking a high-stakes security breach. In some instances, the perceived threat is so severe that administrators have reportedly begun taking their appliances offline entirely rather than waiting for an official patch to become available.

The severity of the situation is underscored by the role that NetScaler ADC and NetScaler Gateway play within an organization’s digital infrastructure. Positioned at the very edge of the enterprise network, these devices are designed to manage and secure the flow of traffic between the public internet and internal corporate resources. Because they are responsible for authenticating users and managing encrypted connections, a remote code execution vulnerability in these systems is particularly catastrophic. An attacker who successfully exploits such a flaw could theoretically gain a foothold at the perimeter, bypass traditional security controls, and pivot deeper into the internal network to exfiltrate sensitive data or deploy ransomware.

According to watchTowr, these new flaws are distinct from previous vulnerabilities that have plagued the Citrix ecosystem in recent months. Specifically, they are not related to CVE-2026-19490, a critical authentication bypass vulnerability that Citrix addressed on August 19 and which the Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalog on September 9. While the August fix addressed a significant risk, the emergence of these two new RCE zero-days suggests that threat actors are relentlessly probing Citrix hardware for additional entry points.

The timeline of the discovery began on September 26, when watchTowr first posted on the social media platform X, indicating that it was investigating rumors of multiple unpatched RCE vulnerabilities affecting NetScaler. At the time, the firm noted that while specific technical details were scarce, the information coming from the field was "credible." A subsequent update provided more clarity, confirming the existence of two separate vulnerabilities that had been discovered during forensic investigations of compromised environments. These findings suggest that the flaws were being utilized by attackers before the security community was even aware of their existence, the very definition of a zero-day exploit.