Active Exploitation of Two New Unpatched Zero-Day Vulnerabilities Discovered in Citrix NetScaler Appliances

The guidance provided by Citrix for suspected compromises generally involves a series of forensic and remediative steps, including the preservation of system logs and the analysis of core dumps. However, the effectiveness of these measures depends heavily on the specific nature of the exploit and the sophistication of the attacker. The 2025 scripts provided by the Dutch NCSC, which cover live appliances and full system images, remain a resource for some, though they come with no guarantee of success against these newer, undocumented flaws. Those scripts were last updated in September 2025 and were designed to look for general patterns of compromise rather than a single specific vulnerability.

Further complicating the landscape is the lifecycle of the NetScaler software itself. Citrix’s release schedule indicates that NetScaler version 13.1 reached its End of Maintenance (EoM) milestone on September 15, 2026. This timing is particularly troublesome for organizations still running that version, as it is currently unclear whether Citrix will provide a backported security fix for a version that has officially moved out of its primary maintenance window. If a patch is only released for newer builds, such as 14.1, organizations on legacy versions may find themselves forced into a rapid and potentially unstable upgrade cycle in the midst of an active security crisis.

The current situation highlights a broader trend in the cybersecurity landscape where edge devices and network appliances have become the primary targets for advanced persistent threat (APT) groups and sophisticated cybercriminals. Because these devices often lack the same level of visibility and endpoint detection and response (EDR) coverage as internal servers and workstations, they can serve as "blind spots" for security teams. When a vulnerability is found in such a device, it provides a powerful, unmonitored gateway into the heart of an enterprise.

As the industry waits for the expected disclosures during the week of September 28, the advice for NetScaler operators remains focused on vigilance and caution. The decision to take a critical piece of infrastructure offline is never easy, but in the absence of a patch or official workaround, it remains one of the few guaranteed ways to prevent exploitation. For those who must keep their systems running, the focus shifts to intensive monitoring of network traffic, looking for unusual outbound connections or unauthorized changes to system configurations that might indicate an active breach.

Cloud Software Group, the parent company of Citrix and NetScaler, has been contacted for comment regarding the reports from watchTowr and the community concerns, but a formal statement has not yet been issued. Until the company provides a definitive path forward, the cybersecurity community remains in a state of high alert, bracing for the full disclosure of the vulnerabilities and the inevitable scramble to secure the digital perimeter. The events of the coming days will likely determine the scale of the impact and whether this will be remembered as another major turning point in the ongoing battle to secure the enterprise edge.