Citrix NetScaler Hit by Two Unpatched RCE Zero-Days

If you run a Citrix NetScaler ADC or NetScaler Gateway that faces the internet, the advice circulating since Friday is blunt: take it offline if you can, and lock it to known IP addresses if you can't. Security firm watchTowr said on September 26 that two unpatched remote code execution flaws in the appliances are being exploited in the wild, and as of Sunday, September 27, Citrix has published no advisory, no CVE numbers and no fix.

That combination is rare even for NetScaler, a product line that has spent most of 2026 in emergency mode. Usually defenders get a patch and a race. This time they get a race and no patch, with Citrix fixes reportedly due early in the week of September 28.

RelatedSonicWall's SMA1000 Hit by Third Zero-Day Chain in a Year

What do we actually know about the two zero-days?

Less than anyone would like, and it is worth being precise about the sourcing. watchTowr, whose researchers have taken apart several earlier NetScaler bugs, posted on X that there are two vulnerabilities, both remote code execution, both unpatched, both exploited before any fix existed, and both found during forensic investigations of compromised customer environments. The firm called the rumors that had been circulating among administrators credible. It also said one of the flaws lets an attacker place shellcode directly into memory.

BleepingComputer reports that the Dutch NCSC received word from a European partner CERT and that exploitation has been seen at multiple Citrix customers worldwide. The Dutch warning went out as a pre-notification under restricted TLP handling rather than a public advisory, which is why most admins first heard about it secondhand. On the r/Citrix subreddit, posts from September 25 describe IT suppliers telling customers there was no fix yet and to shut the appliances down.

What is missing matters just as much. There are no CVE identifiers, no affected build list, no indicators of compromise and no public proof of concept. Citrix has not confirmed the flaws.

Is this the same bug Citrix already patched in August?

No, and this is the most common misreading so far. Citrix fixed an authentication bypass, CVE-2026-19490, in bulletin CTX696939 on August 19, and CISA added it to the Known Exploited Vulnerabilities catalog on September 9. watchTowr said explicitly that the new activity involves different vulnerabilities. If you patched for 19490 last month, that does not protect you here.

It is also not the SAML heap overflow we covered in August, CVE-2026-8452, which was patched in June and then used to drop web shells two months later. Nor is it the CVE-2026-8451 memory leak from July that drew CitrixBleed comparisons. Count them and this is the fourth serious NetScaler emergency of the year.

Why is "shut it down" the advice instead of "patch"?

Because there is nothing to install. A NetScaler Gateway sits at the edge on purpose. It is the thing remote workers log into, so it has to accept connections from anywhere, and a pre-authentication code execution bug in that position hands an attacker a foothold on a device that usually holds session state, credentials in transit and a trusted route into the internal network.

So the mitigations on offer are all about exposure. The ones being repeated by the Dutch NCSC notice, watchTowr and the coverage that followed:

RelatedCitrix NetScaler CVE-2026-8452: Patched in June, Exploited in August

• Take internet-facing appliances offline where the business can live without remote access for a few days.
• Restrict inbound TCP 443 to known corporate or partner IP ranges where it can't.
• Never expose the management interface to the internet, and disable VPN virtual servers you are not actually using.
• Hunt now, not after the patch. Look for unexpected processes, crash dumps and new files in the appliance's web directories. Exploitation was found through forensics, so some victims were compromised before anyone knew to look.

That last point is the one people skip. A patch closes the door. It does nothing about someone already inside, and with 8452 the web shells outlived the fix by weeks.

Who is most exposed?

Any organization whose remote access still depends on an internet-facing NetScaler Gateway, which in practice means a lot of governments, hospitals and mid-sized enterprises that standardized on Citrix years ago. The Netherlands has been here before. The Dutch NCSC told organizations to switch Citrix gateways off in January 2020 during the CVE-2019-19781 attacks, and Dutch organizations were hit again through CVE-2025-6543 last year. A regional CERT reaching for the same instruction again tells you how seriously they rate this.

Taking remote access offline is expensive, which is exactly why some teams will be tempted to wait for Citrix. That is a bet that nobody has scanned your appliance yet, and for exposed NetScalers that bet has been losing for most of the year.

Our take

The unusual thing here is not that NetScaler has another critical bug. It is that the warning reached admins through Reddit threads and a restricted CERT notice before the vendor said a word. For a device whose entire job is to sit on the internet, three days of silence is a long time. If you run one, treat Friday's advice as the patch for now: cut exposure, then go looking for anything that already got in. When Citrix's fix lands, apply it and keep hunting, because a patch has never evicted anyone.

Original analysis by GenZTech. Citrix had not published an advisory at the time of writing; we will update this post when it does.