Two New Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Under Active Exploitation

The enterprise cybersecurity landscape is facing a significant, emerging threat as reports surface regarding two unpatched, zero-day remote code execution (RCE) vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. As of late September 2026, the security firm watchTowr has identified that these vulnerabilities are being actively weaponized in the wild. The discovery has prompted urgent, albeit informal, security advisories across the industry, leading some organizations to preemptively take their critical edge infrastructure offline to mitigate the risk of unauthorized access.

The Anatomy of the Threat

Citrix NetScaler ADC and NetScaler Gateway serve as the foundational edge components for a vast number of enterprise networks globally. These appliances are responsible for high-stakes tasks, including load balancing, SSL/TLS offloading, VPN connectivity, and complex user authentication. By residing at the perimeter of the corporate network, these devices are inherently high-value targets for threat actors seeking an initial foothold in a target environment.

The current situation is particularly concerning because the vulnerabilities—both of which enable remote code execution—are currently unpatched. Unlike previous security incidents involving Citrix, where a CVE identifier was assigned and a patch cycle initiated, these two flaws were identified through forensic investigations in the wild before the vendor could release any formal mitigation or public advisory.

Chronological Breakdown of the Incident

The awareness of these vulnerabilities began to coalesce in the final week of September 2026.

• September 26, 2026: Security firm watchTowr publicly signaled on the social media platform X that it had uncovered credible reports of multiple, unpatched RCE vulnerabilities impacting NetScaler products.
• Late September 26, 2026: A follow-up disclosure provided further clarity, confirming that two distinct RCE vulnerabilities had been discovered during forensic analysis of compromised systems.
• September 27, 2026: Widespread chatter began appearing on professional forums, most notably Reddit’s r/Citrix community. Network administrators reported receiving urgent, undocumented guidance from their managed service providers and security partners to power down or isolate their NetScaler appliances immediately.
• September 28, 2026 (Expected): Industry analysts and security researchers anticipate that Citrix (owned by Cloud Software Group) will provide formal communication, potential workarounds, or emergency hotfixes early in the week.

Distinguishing from Past Incidents

It is imperative for security teams to distinguish these new zero-days from previously disclosed flaws. Specifically, these vulnerabilities are not related to CVE-2026-19490, an authentication bypass flaw that Citrix patched on August 19, 2026, and which was subsequently added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on September 9.

While the August patch addressed a critical bypass, the existence of a fix for that issue provides no protection against the current, newly discovered RCE threats. Citrix has yet to clarify whether specific builds, including the August releases (14.1-73.32 and 13.1-63.21), contain the components vulnerable to the new RCE chain.

Industry Response and Operational Challenges

The lack of a vendor-issued bulletin has created an information vacuum. In such scenarios, the burden of risk management shifts entirely to the end-user. The decision-making process for IT departments is fraught with difficulty: keep the appliances online to maintain business continuity and risk compromise, or power them off and effectively sever remote access for the organization.

The caution advised by IT suppliers stems from the reality that, in modern cyberattacks, the "patching" process is often insufficient. If an attacker has already gained a foothold via a zero-day, simply applying a patch does not eject the adversary from the network. This was a hard-learned lesson in 2025, when the Dutch National Cyber Security Center (NCSC-NL) observed attackers maintaining persistence on Citrix appliances even after security updates were applied. At that time, the NCSC-NL emphasized that administrators must perform deep-dive forensic checks to ensure the environment is truly clean.

Technical Implications and Forensic Limitations

The current threat highlights a critical limitation in incident response. When an exploit is used as a zero-day, it often leaves behind minimal artifacts, or the artifacts are buried within encrypted traffic or transient memory states.

Existing guidance from Citrix for suspected compromises includes reviewing audit logs, monitoring for unauthorized command execution, and inspecting for file system modifications. However, the efficacy of these measures depends heavily on the sophistication of the attacker. If an attacker gains full system access through an RCE vulnerability, they can often clear logs or modify the very tools administrators use to check for integrity.

The NCSC-NL’s 2025 check scripts, while a useful resource, are now a year old. While they remain available on platforms like GitHub, they are not a silver bullet. The README documentation for these scripts clearly states they are not a comprehensive security solution and lack a guarantee of effectiveness against evolving exploitation techniques.

The Lifecycle Management Dilemma

Adding to the complexity is the status of NetScaler firmware versions. NetScaler 13.1 reached its "End of Maintenance" milestone on September 15, 2026. Under standard support lifecycles, this raises questions about whether older, yet widely deployed, versions will receive a patch at all. If Citrix decides to exclude 13.1 from the security update cycle, thousands of organizations may be forced into an emergency, unplanned, and high-risk migration to a newer version of the software while simultaneously fighting an active, ongoing breach.

Broader Cybersecurity Context

The recurrence of critical vulnerabilities in edge devices like NetScaler, F5 Big-IP, and VPN concentrators points to a persistent systemic weakness in the modern enterprise architecture. Because these devices act as the "front door" to the corporate network, any vulnerability in their code—especially those involving RCE—effectively grants the attacker the keys to the kingdom.

The fact that these vulnerabilities were uncovered by private security firms like watchTowr, rather than through the vendor’s internal QA or bug bounty programs, highlights the importance of independent security research. However, it also suggests that the current cadence of software development in the networking hardware sector may be failing to keep pace with the evolving capabilities of threat actors.

Recommended Actions for Administrators

While the industry awaits official word from Cloud Software Group, the following best practices are generally advised for organizations operating NetScaler appliances:

1. Monitor for Official Communications: Frequently check the Citrix Support portal for new security bulletins or technical alerts.
2. Evaluate Exposure: If possible, move the management interface of the NetScaler to an out-of-band network segment that is not accessible from the public internet.
3. Implement Temporary Restrictions: Consider limiting access to the NetScaler gateway to known, trusted IP ranges (e.g., via IP whitelisting) to reduce the attack surface.
4. Forensic Preparedness: Prepare to perform deep-level forensic analysis. If an appliance shows signs of unusual CPU spikes, unauthorized administrative logins, or unexpected outbound traffic, assume a compromise and follow your organization’s incident response plan, which usually involves disconnecting the affected device from the network.
5. Review Support Lifecycle: Verify your current firmware version against the Citrix support lifecycle matrix. If your version is EOL (End of Life) or EOM (End of Maintenance), prioritize a roadmap for upgrading to a supported version immediately, as security patches for older versions are unlikely to be forthcoming.

As the situation develops, the global cybersecurity community remains on high alert. The potential for these vulnerabilities to be used in widespread, automated ransomware campaigns or large-scale data exfiltration efforts is high. Until an official patch is released and verified, the safest posture remains one of extreme caution, prioritizing the isolation of edge devices to prevent lateral movement within the network.