Active Exploitation of Two New Unpatched Zero-Day Vulnerabilities Discovered in Citrix NetScaler Appliances

The security firm’s report indicated that official communications and patches from Citrix are expected to arrive early in the week of September 28. However, the interval between the discovery of active exploitation and the release of a patch represents a window of extreme vulnerability for global enterprises. The firm has not yet released specific evidence of the exploits, nor has it named the victims or the specific entities whose forensic investigations led to the discovery. This lack of public detail is common in the early stages of zero-day disclosures, as researchers often coordinate with vendors to prevent providing a roadmap for other malicious actors before a defense is ready.

The impact of the news was felt almost immediately across IT forums and community hubs. On the r/Citrix subreddit, administrators began sharing accounts of urgent warnings received from their managed service providers and security partners. One administrator noted that their IT supplier’s security team had called to advise an immediate shutdown of all NetScaler appliances, though the supplier was unable to provide specific technical details at the time. Other members of the community echoed these sentiments, reporting that their organizations had opted to isolate or power down their gateways as a precautionary measure.

The source of the warnings received by these suppliers remains unconfirmed, but the grassroots reaction highlights the level of distrust and concern currently surrounding edge-device security. Without an official vendor bulletin, there are currently no recommended workarounds or official indicators of compromise (IoCs) that administrators can use to scan their systems. This leaves defenders in a reactive posture, struggling to decide whether to keep their systems online, move them into an isolated "sandbox" environment, or shut them down and disrupt business operations.

A significant concern for organizations is the realization that simply applying a future patch may not be enough to secure their environments. Because these vulnerabilities were exploited before a fix was available, there is a distinct possibility that attackers have already established persistence within affected networks. This "post-exploitation" reality means that even after an appliance is updated to a secure version, an attacker who gained access earlier could still maintain a presence through backdoors, compromised credentials, or other lateral movement techniques.

This situation mirrors a major security incident in 2025, when a different NetScaler flaw was exploited as a zero-day against various organizations in the Netherlands. At that time, the Dutch National Cyber Security Center (NCSC) issued a stern warning to administrators, stating that updating the software alone was insufficient to mitigate the risk. The NCSC emphasized that if an attacker had already gained entry, they could retain access regardless of the patch. To combat this, the agency released specialized check scripts designed to help administrators identify signs of unauthorized access that might persist after a system was updated.