Two new zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, and as of September 26, Citrix has neither confirmed the flaws nor published a fix, which leaves administrators in the uncomfortable position of deciding whether to keep their appliances online or take them down.

Security firm watchTowr reported the activity, and some administrators say they have already taken appliances offline rather than wait for a patch that may not arrive for days.

NetScaler ADC and NetScaler Gateway sit at the edge of enterprise networks, where they handle VPN and remote access, load balancing, and user authentication, so a remote code execution flaw in these appliances is about as serious as an edge vulnerability gets.

Quick Summary

What watchTowr Actually Said

watchTowr's first post on X on September 26 said it was reacting to rumors of several unpatched NetScaler RCE vulnerabilities in the wild, and it wrote that while details are scarce, the information is credible.

A follow-up post at 22:19 UTC gave a fuller account, saying there are two vulnerabilities, both remote code execution, both unpatched, both exploited before any fix existed, and both discovered during forensic investigations, with Citrix communications and patches expected early in the week of September 28, and it directed further questions to Citrix.

The firm has published no evidence, named no victim, and has not said whose forensic investigations found the exploitation, which means the public picture is still incomplete.

For context, in August, watchTowr showed that a NetScaler heap overflow Citrix had patched in June could be used for remote code execution, so the firm has a track record of digging into NetScaler flaws.

What This Is Not

The new flaws are not the authentication bypass tracked as CVE-2026-19490, which Citrix fixed on August 19 and which CISA added to its Known Exploited Vulnerabilities catalog on September 9.

watchTowr described the new flaws as unpatched, and a fix for the bypass has existed since August 19, so these are separate issues, and Citrix has not said whether appliances on the August builds, 14.1-73.32 and 13.1-63.21, or any newer builds, are affected by the new flaws.

That uncertainty matters, because administrators cannot easily tell whether patching to the August build protects them from the new zero-days.

The Shutdown Advice

Reports of shutdown advice appeared on Reddit the same day, and an administrator posting on r/Citrix wrote that their IT supplier's security team had phoned to advise shutting their NetScalers down immediately, without giving details.

Others in the thread said their organizations had done the same, so the advice is circulating informally even though no vendor bulletin exists.

The source of the suppliers' warning is not established, and with no bulletin, there is no vendor workaround and no indicators of compromise for the new flaws have been published, which leaves defenders with very little to work with.

Until a fix ships, the decision for anyone running a NetScaler is whether to keep it online, isolate it, or power it off, and whether to treat it as already compromised.

Why the Fix Won't Tell You Everything

Because the exploitation, as watchTowr describes it, happened before any fix existed, installing the fix will not tell an operator whether an attacker got in first.

That is a critical point, because it means patching is necessary but not sufficient, and administrators need to assume compromise until they have evidence to the contrary.

In 2025, after a NetScaler flaw was exploited as a zero-day against Dutch organizations, the Netherlands' National Cyber Security Center said that updating alone did not remove the risk, because an attacker could keep access gained before the patch, and it told administrators to run its check scripts.

So there is precedent for this exact situation, and the lesson from last time is that patching is only the first step.

Citrix's Existing Guidance for Suspected Compromise

Citrix's existing guidance for a suspected NetScaler compromise says to preserve evidence first, including a snapshot of a VPX instance, the logs held on remote syslog servers and NetScaler Console, a technical support bundle, and a core dump of the packet engine.

Then isolate the appliance from the network, change every service account password and secret stored on it, reset the passwords of users who signed in through it, and revoke its certificates and private keys.

The guidance also says to keep the management interface off the internet, noting that the NetScaler Management Services should never be exposed to the public internet.

The Dutch agency's 2025 check scripts, which cover a live appliance, core dumps, and full NetScaler images, are a further option, though with limits, because the README for the live-appliance script says it looks for files that indicate compromise, is not specific to one vulnerability, and comes with no guarantee of effectiveness, and the code was last updated in September 2025.

The Version Question

Which versions of NetScaler would receive a fix is also open, because NetScaler 13.1 reached End of Maintenance on September 15 under Citrix's release schedule, and Citrix has not said whether it will get one.

So organizations running 13.1 may be left without a patch entirely, which makes the decision to isolate or replace those appliances more urgent.

Citrix had published nothing about the new flaws as of Sunday morning, and The Hacker News has asked Cloud Software Group, the company that owns Citrix and NetScaler, and watchTowr for comment.

What You Should Do

• Treat any internet-facing NetScaler as potentially compromised until you have evidence otherwise.
• Preserve evidence before making changes, because logs and dumps are your only way to investigate later.
• Isolate the appliance from the network if you cannot take it offline entirely.
• Rotate every service account password, user password, certificate, and private key tied to the appliance.
• Keep the management interface off the public internet, which is baseline guidance even without an active incident.
• Run the Dutch NCSC check scripts if you need a starting point, but understand their limitations.
• Watch for Citrix communications early in the week of September 28, and be ready to patch immediately when a fix arrives.
• Assume that patching alone does not remove access an attacker gained before the patch.

The Bottom Line

Two unpatched Citrix NetScaler zero-days allow remote code execution and are being actively exploited, and with no fix, no workaround, and no indicators of compromise published yet, administrators are left to decide whether to keep appliances online, isolate them, or power them off, and to assume compromise until proven otherwise, because the exploitation happened before any patch existed, and that means a fix will not tell you whether an attacker got in first.

Quick Reference

What to Do

• Treat NetScaler as potentially compromised
• Preserve evidence first
• Isolate the appliance
• Rotate credentials and certificates
• Keep management interface offline
• Run check scripts with caution
• Watch for Citrix patches
• Assume patching alone is not enough

FAQ Section

What are the new Citrix NetScaler zero-days?

Two unpatched remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway, reported by watchTowr on September 26, 2026, and actively exploited in the wild.

Are they the same as CVE-2026-19490?

No, CVE-2026-19490 is an authentication bypass that Citrix patched on August 19, and the new flaws are separate and unpatched.

Has Citrix confirmed the flaws?

No, Citrix has not confirmed the flaws or published a fix as of September 26, and it has not said whether the August builds are affected.

Why does patching not solve everything?

Because the exploitation happened before any fix existed, so installing a patch will not tell you whether an attacker already gained access.

What should I do if I run NetScaler?

Preserve evidence, isolate the appliance, rotate credentials and certificates, keep the management interface off the internet, and assume compromise until proven otherwise.

When will a fix be available?

watchTowr said Citrix communications and patches are expected early in the week of September 28, 2026.

Source: The Hacker News