Active Exploitation of Two New Unpatched Zero-Day Vulnerabilities Discovered in Citrix NetScaler Appliances

Security researchers and enterprise IT departments are on high alert following reports of two new unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. These flaws, which reportedly allow for remote code execution (RCE), are being actively exploited in the wild, according to a disclosure from the security firm watchTowr on September 26, 2026. The revelation has sent shockwaves through the cybersecurity community, as these appliances serve as critical gatekeepers for corporate networks, handling everything from remote access and virtual private networks (VPNs) to sophisticated load balancing and user authentication.

As of Sunday morning, Citrix has not officially confirmed the existence of these specific flaws, nor has the company published a security bulletin or a technical fix. The lack of an official response from the vendor has left system administrators in a precarious position, forced to choose between maintaining essential network services and risking a high-stakes security breach. In some instances, the perceived threat is so severe that administrators have reportedly begun taking their appliances offline entirely rather than waiting for an official patch to become available.

The severity of the situation is underscored by the role that NetScaler ADC and NetScaler Gateway play within an organization’s digital infrastructure. Positioned at the very edge of the enterprise network, these devices are designed to manage and secure the flow of traffic between the public internet and internal corporate resources. Because they are responsible for authenticating users and managing encrypted connections, a remote code execution vulnerability in these systems is particularly catastrophic. An attacker who successfully exploits such a flaw could theoretically gain a foothold at the perimeter, bypass traditional security controls, and pivot deeper into the internal network to exfiltrate sensitive data or deploy ransomware.

According to watchTowr, these new flaws are distinct from previous vulnerabilities that have plagued the Citrix ecosystem in recent months. Specifically, they are not related to CVE-2026-19490, a critical authentication bypass vulnerability that Citrix addressed on August 19 and which the Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalog on September 9. While the August fix addressed a significant risk, the emergence of these two new RCE zero-days suggests that threat actors are relentlessly probing Citrix hardware for additional entry points.

The timeline of the discovery began on September 26, when watchTowr first posted on the social media platform X, indicating that it was investigating rumors of multiple unpatched RCE vulnerabilities affecting NetScaler. At the time, the firm noted that while specific technical details were scarce, the information coming from the field was "credible." A subsequent update provided more clarity, confirming the existence of two separate vulnerabilities that had been discovered during forensic investigations of compromised environments. These findings suggest that the flaws were being utilized by attackers before the security community was even aware of their existence, the very definition of a zero-day exploit.

The security firm’s report indicated that official communications and patches from Citrix are expected to arrive early in the week of September 28. However, the interval between the discovery of active exploitation and the release of a patch represents a window of extreme vulnerability for global enterprises. The firm has not yet released specific evidence of the exploits, nor has it named the victims or the specific entities whose forensic investigations led to the discovery. This lack of public detail is common in the early stages of zero-day disclosures, as researchers often coordinate with vendors to prevent providing a roadmap for other malicious actors before a defense is ready.

The impact of the news was felt almost immediately across IT forums and community hubs. On the r/Citrix subreddit, administrators began sharing accounts of urgent warnings received from their managed service providers and security partners. One administrator noted that their IT supplier’s security team had called to advise an immediate shutdown of all NetScaler appliances, though the supplier was unable to provide specific technical details at the time. Other members of the community echoed these sentiments, reporting that their organizations had opted to isolate or power down their gateways as a precautionary measure.

The source of the warnings received by these suppliers remains unconfirmed, but the grassroots reaction highlights the level of distrust and concern currently surrounding edge-device security. Without an official vendor bulletin, there are currently no recommended workarounds or official indicators of compromise (IoCs) that administrators can use to scan their systems. This leaves defenders in a reactive posture, struggling to decide whether to keep their systems online, move them into an isolated "sandbox" environment, or shut them down and disrupt business operations.

A significant concern for organizations is the realization that simply applying a future patch may not be enough to secure their environments. Because these vulnerabilities were exploited before a fix was available, there is a distinct possibility that attackers have already established persistence within affected networks. This "post-exploitation" reality means that even after an appliance is updated to a secure version, an attacker who gained access earlier could still maintain a presence through backdoors, compromised credentials, or other lateral movement techniques.

This situation mirrors a major security incident in 2025, when a different NetScaler flaw was exploited as a zero-day against various organizations in the Netherlands. At that time, the Dutch National Cyber Security Center (NCSC) issued a stern warning to administrators, stating that updating the software alone was insufficient to mitigate the risk. The NCSC emphasized that if an attacker had already gained entry, they could retain access regardless of the patch. To combat this, the agency released specialized check scripts designed to help administrators identify signs of unauthorized access that might persist after a system was updated.

The guidance provided by Citrix for suspected compromises generally involves a series of forensic and remediative steps, including the preservation of system logs and the analysis of core dumps. However, the effectiveness of these measures depends heavily on the specific nature of the exploit and the sophistication of the attacker. The 2025 scripts provided by the Dutch NCSC, which cover live appliances and full system images, remain a resource for some, though they come with no guarantee of success against these newer, undocumented flaws. Those scripts were last updated in September 2025 and were designed to look for general patterns of compromise rather than a single specific vulnerability.

Further complicating the landscape is the lifecycle of the NetScaler software itself. Citrix’s release schedule indicates that NetScaler version 13.1 reached its End of Maintenance (EoM) milestone on September 15, 2026. This timing is particularly troublesome for organizations still running that version, as it is currently unclear whether Citrix will provide a backported security fix for a version that has officially moved out of its primary maintenance window. If a patch is only released for newer builds, such as 14.1, organizations on legacy versions may find themselves forced into a rapid and potentially unstable upgrade cycle in the midst of an active security crisis.

The current situation highlights a broader trend in the cybersecurity landscape where edge devices and network appliances have become the primary targets for advanced persistent threat (APT) groups and sophisticated cybercriminals. Because these devices often lack the same level of visibility and endpoint detection and response (EDR) coverage as internal servers and workstations, they can serve as "blind spots" for security teams. When a vulnerability is found in such a device, it provides a powerful, unmonitored gateway into the heart of an enterprise.

As the industry waits for the expected disclosures during the week of September 28, the advice for NetScaler operators remains focused on vigilance and caution. The decision to take a critical piece of infrastructure offline is never easy, but in the absence of a patch or official workaround, it remains one of the few guaranteed ways to prevent exploitation. For those who must keep their systems running, the focus shifts to intensive monitoring of network traffic, looking for unusual outbound connections or unauthorized changes to system configurations that might indicate an active breach.

Cloud Software Group, the parent company of Citrix and NetScaler, has been contacted for comment regarding the reports from watchTowr and the community concerns, but a formal statement has not yet been issued. Until the company provides a definitive path forward, the cybersecurity community remains in a state of high alert, bracing for the full disclosure of the vulnerabilities and the inevitable scramble to secure the digital perimeter. The events of the coming days will likely determine the scale of the impact and whether this will be remembered as another major turning point in the ongoing battle to secure the enterprise edge.