Citrix NetScaler zero-day RCE flaws exploited in the wild, no patch yet

September 27, 2026 at 12:47 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances allow remote code execution and are being actively exploited, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or released a fix, and some administrators have taken appliances offline. The flaws are distinct from CVE-2026-19490, an authentication bypass Citrix patched on August 19.

Key Facts

watchTowr reported on September 26 that two unpatched remote code execution flaws in Citrix NetScaler ADC and Gateway are being actively exploited.
Citrix has not confirmed the new flaws or published a patch, and no vendor workaround or indicators of compromise are available.
The new flaws are separate from CVE-2026-19490, an authentication bypass Citrix fixed on August 19 and CISA added to its Known Exploited Vulnerabilities catalog on September 9.
Administrators on Reddit reported that IT suppliers advised shutting down NetScaler appliances immediately, and some organizations complied.
watchTowr said Citrix communications and patches are expected early in the week of September 28.

The Vulnerabilities

watchTowr said the two flaws affect Citrix NetScaler ADC and NetScaler Gateway appliances, which handle VPN, remote access, load balancing, and authentication at the network edge. Both vulnerabilities allow remote code execution and were exploited before any fix existed, according to the firm's post at 22:19 UTC on September 26. The flaws were discovered during forensic investigations, but watchTowr did not name any victim or say whose investigations found the exploitation. Citrix has not stated whether the August builds 14.1-73.32 and 13.1-63.21 or newer builds are affected.

Response and Risk

Citrix has not confirmed the vulnerabilities or released a fix, leaving administrators without a vendor workaround or published indicators of compromise. On Reddit, an administrator on r/Citrix wrote that their IT supplier's security team advised shutting down NetScalers immediately, and others in the thread said their organizations did the same. The source of the suppliers' warning is not established, and until a fix ships, operators must decide whether to keep appliances online, isolate them, or power them off. Because exploitation occurred before any fix existed, installing a future patch will not reveal whether an attacker already gained access. In 2025, after a NetScaler zero-day was exploited against Dutch organizations, the Netherlands' National Cyber Security Center warned that updating alone did not remove risk and advised running check scripts.