Attackers are exploiting two unpatched NetScaler RCE flaws, watchTowr says
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
The Watch · Security desk
What happened
- Citrix has not confirmed the flaws or said whether appliances on the August builds, 14.1-73.32 and 13.1-63.21, or anything newer are affected.
- watchTowr said the attacks were found during forensic investigations and that Citrix communications and patches are expected early in the week of September 28.
- On r/Citrix, an administrator said their IT supplier had phoned to advise shutting NetScalers down immediately, and others said their organizations had done the same.
Why it matters
- Who has to decide decision Because watchTowr places the exploitation before any fix, installing Citrix's patch when it ships will not show whether an attacker is already inside, so the compromise assessment cannot wait for the patch.
- What it limits constraint Without Citrix indicators of compromise or a workaround, a clean result from the Dutch NCSC's generic 2025 check scripts, whose README offers no guarantee of effectiveness, does not clear an appliance.
- Who's exposed exposure Operators still on 13.1 may get no patch at all, since the branch left maintenance 11 days before watchTowr's warning and Citrix has not said it will be fixed.
Next story · Security · Oct 4
Third NetScaler zero-day hits SAML appliances already patched against the first twoConfirmed11 publishers
Everything public so far comes from watchTowr. Its first post on X on September 26 said it was reacting to rumors of several unpatched NetScaler RCE vulnerabilities in the wild [5]. "While details are scarce, the information is credible," it wrote [6]. A follow-up at 22:19 UTC gave the fuller account and directed further questions to Citrix [7]. The firm has worked on this product before. In August it showed that a heap overflow Citrix patched in June could be used for remote code execution [19].
Citrix had published nothing about the new flaws as of Sunday morning, according to The Hacker News, which asked Cloud Software Group, the owner of Citrix and NetScaler, for comment [11]. Where the IT suppliers' shutdown warnings came from is not established [9].
The target is familiar. NetScaler ADC and Gateway sit at the network edge, handling VPN and remote access, load balancing and user authentication [18]. A NetScaler flaw was exploited as a zero-day against Dutch organizations in 2025 [20]. CISA added the August authentication bypass to its Known Exploited Vulnerabilities catalog on September 9 [3]. watchTowr has released no evidence and named no victim, and it has not said whose forensic investigations found the exploitation [12]. On that record there is no basis yet for tying the new attacks to whoever ran the earlier NetScaler intrusions [12].
After the 2025 zero-day, the Netherlands' National Cyber Security Center said updating alone did not remove the risk, because an attacker could keep access gained before the patch [21]. Citrix's existing guidance for a suspected compromise says to preserve evidence first: a snapshot of a VPX instance, the logs held on remote syslog servers and NetScaler Console, a technical support bundle and a core dump of the packet engine [14]. Next comes isolating the appliance. Then every service account password and secret stored on it gets changed, users who signed in through it get password resets, and its certificates and private keys are revoked [15]. "The NetScaler Management Services should never be exposed to the public internet," the guidance says [16].
Citrix's sequence puts evidence collection ahead of the immediate shutdowns administrators described on r/Citrix [14][8].
What to watch
- Citrix's bulletin, which watchTowr expects early in the week of September 28: whether it names affected builds, including 14.1-73.32 and 13.1-63.21, and publishes indicators of compromise.
- Whether Citrix commits to a fix for NetScaler 13.1 after its September 15 End of Maintenance.
- Whether watchTowr or the unnamed investigators publish evidence or victims, or CISA adds the new flaws to its Known Exploited Vulnerabilities catalog.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 15%
- Operator
- Operator 73%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security firm watchTowr said on September 26 that two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution are being actively exploited in the wild.
- [2]
The new flaws are not the authentication bypass CVE-2026-19490, which Citrix fixed on August 19.
- [3]
CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on September 9.
- [4]
Citrix has not confirmed the flaws or published a fix, and has not said whether appliances on the August builds, 14.1-73.32 and 13.1-63.21, or any newer builds, are affected.
- [5]
watchTowr's first post on X on September 26 said it was reacting to rumors of several unpatched NetScaler RCE vulnerabilities in the wild.
- [6]
"While details are scarce, the information is credible,"
- [7]
A watchTowr follow-up post at 22:19 UTC described two vulnerabilities, both remote code execution, both unpatched, exploited before any fix existed, discovered during forensic investigations, with Citrix communications and patches expected early in the week of September 28; it directed further questions to Citrix.
- [8]
An administrator posting on r/Citrix wrote that their IT supplier's security team had phoned to advise shutting their NetScalers down immediately, without giving details; others in the thread said their organizations had done the same.
- [9]
The source of the IT suppliers' shutdown warning is not established.
- [10]
With no Citrix bulletin, there is no vendor workaround, and no indicators of compromise for the new flaws have been published.
- [11]
Citrix had published nothing about the new flaws as of Sunday morning; The Hacker News asked Cloud Software Group, the company that owns Citrix and NetScaler, and watchTowr for comment.
- [12]
watchTowr has published no evidence, named no victim, and has not said whose forensic investigations found the exploitation.
- [13]
Because the exploitation, as watchTowr describes it, happened before any fix existed, installing the fix will not tell an operator whether an attacker got in first.
- [14]
Citrix's existing guidance for a suspected NetScaler compromise says to preserve evidence first: a snapshot of a VPX instance, the logs held on remote syslog servers and NetScaler Console, a technical support bundle, and a core dump of the packet engine.
- [15]
Citrix's guidance says to isolate the appliance from the network, change every service account password and secret stored on it, reset the passwords of users who signed in through it, and revoke its certificates and private keys.
- [16]
"The NetScaler Management Services should never be exposed to the public internet,"
- [17]
Until a fix ships, the decision for anyone running a NetScaler is whether to keep it online, isolate it, or power it off, and whether to treat it as already compromised.
- [18]
NetScaler ADC and NetScaler Gateway sit at the edge of enterprise networks, where they handle VPN and remote access, load balancing, and user authentication.
- [19]
In August, watchTowr showed that a NetScaler heap overflow Citrix had patched in June could be used for remote code execution.
- [20]
In 2025 a NetScaler flaw was exploited as a zero-day against Dutch organizations.
- [21]
After the 2025 zero-day, the Netherlands' National Cyber Security Center said that updating alone did not remove the risk, because an attacker could keep access gained before the patch.
- [22]
The Dutch agency's 2025 check scripts cover a live appliance, core dumps, and full NetScaler images; the README for the live-appliance script says it looks for files that indicate compromise, is not specific to one vulnerability, and comes with no guarantee of effectiveness. The code was last updated in September 2025.
- [23]
NetScaler 13.1 reached End of Maintenance on September 15 under Citrix's release schedule, and Citrix has not said whether it will get a fix.
- [24]
NetScaler 13.1 reached End of Maintenance 11 days before watchTowr's September 26 disclosure.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCitrix admins warned to shut down NetScalers over 2 exploited zero-days
1 article · September 27, 2026
- tenable.comFrequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
1 article · September 27, 2026
- thehackernews.comWarning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
1 article · September 27, 2026