Over the weekend of September 27, security teams running Citrix NetScaler appliances faced a choice no operator wants: keep critical infrastructure exposed, isolate it, or pull the plug entirely. Security firm watchTowr disclosed two unpatched RCE zero-days in NetScaler ADC and NetScaler Gateway on September 26, both under active exploitation. Citrix has not confirmed the flaws, published a fix, or released a workaround. Some administrators have already taken appliances offline rather than wait for a patch that may not arrive until early the following week. The two new NetScaler RCE zero-days have no CVE assignment, no patch, and no vendor mitigation as of September 27, leaving operators with nothing to install and no official guidance to follow.
This is not the first time NetScaler has been in the crosshairs in 2026. Citrix patched CVE-2026-19490, an authentication bypass with a CVSS v4.0 score of 9.3, on August 19. CISA added it to its Known Exploited Vulnerabilities catalog on September 9. The new flaws disclosed by watchTowr are separate, potentially more severe in impact, and completely unpatched. They arrive on top of a 48-hour exploitation wave that has hit PeopleSoft, SharePoint, WSO2, MikroTik, and WordPress, making this a particularly bad weekend to operate perimeter infrastructure.
What exactly is under attack?
The target is NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), appliances that sit at the network edge handling traffic management, load balancing, and SSL VPN access. These are perimeter devices, often internet-facing, which makes unpatched RCE flaws particularly dangerous. An attacker with remote code execution on a NetScaler Gateway has a foothold inside the VPN boundary, with access to session tokens, credentials, and private keys that pass through the appliance.
watchTowr described the two vulnerabilities as remote code execution, both unpatched, both exploited before any fix existed, and both discovered during forensic investigations. The firm disclosed its findings on September 26 and directed further questions to Citrix. A follow-up post at 22:19 UTC gave a fuller account: Citrix communications and patches are expected early in the week of September 28.
The Cyber Kendra report noted that the two flaws allow remote code execution with little effort and have not yet been assigned CVE IDs or severity scores. The source of the suppliers' warning that spread through admin communities over the weekend is not established. No official advisory from Citrix or the Dutch National Cyber Security Centre covers these specific new flaws.
The most recent NetScaler bulletin, CTX696939, covers CVE-2026-19489 and CVE-2026-19490, which were patched on August 19. NCSC-NL's newest public advisory, NCSC-2026-0318, covers those same two flaws and raised its rating to high. Neither document mentions the new zero-days.
How do these new zero-days differ from the August patches?
The distinction matters because operators who applied the August 19 patch may assume they are safe. They are not confirmed to be.
The August patch addressed two vulnerabilities. CVE-2026-19490 is an authentication bypass using an alternate path with a CVSS v4.0 score of 9.3, allowing an unauthenticated attacker to bypass authentication and compromise an affected system. The Cyber Security Agency of Singapore confirmed that a publicly available proof-of-concept exploit exists and exploitation attempts have been observed in the wild. CVE-2026-19489 is a classic buffer overflow with a CVSS v4.0 score of 8.8, allowing memory overflow leading to unpredictable system behavior or denial of service.
Both were patched in builds 14.1-73.32 and 13.1-63.21. The Canadian Centre for Cyber Security confirmed that CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities database on September 9.
The new zero-days disclosed by watchTowr are distinct. They are remote code execution flaws, separate from the authentication bypass and buffer overflow issues patched in August. They have no CVE IDs, no CVSS scores, no patch, and no official advisory. Cyber Kendra reported that with no advisory published, it is unknown which NetScaler configurations or builds are affected, including whether appliances on the latest fixed builds, 14.1-73.32 and 13.1-63.21, are exposed.
The chart above shows the CVSS v4.0 scores for the two known NetScaler CVEs from the Cyber Security Agency of Singapore. The two new unpatched RCE zero-days disclosed by watchTowr have no assigned CVSS score, shown as 0 pending official assessment.
Which NetScaler configurations are at risk?
For the August patched CVEs, Citrix specified that the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server to be vulnerable. For builds 14.1-43.56 and later, and 13.1-61.28 and later, the appliance must also be configured with a SAML action. Earlier builds with Gateway or AAA configuration are vulnerable without the SAML precondition.
The same Canadian advisory recommended checking configurations for SAML authentication deployments and prioritizing patching of affected systems on an emergency basis. Organizations should determine the current software version on each appliance, identify NetScaler appliances configured as Gateway services or AAA virtual servers, and review configurations for SAML authentication deployments where applicable.
For the new unpatched zero-days, no such configuration guidance exists. The attack surface is undefined. Any NetScaler ADC or Gateway appliance configured for any gateway, proxy, or AAA role should be considered potentially exposed until Citrix publishes an advisory.
The preconditions for the August CVEs at least gave operators a filter: if you were not running Gateway or AAA, you had breathing room. The new zero-days remove that filter. Without an advisory, the safe assumption is that any internet-facing NetScaler is at risk.
What should you do right now with no patch available?
This is the section to screenshot. With no patch, no workaround, and no indicators of compromise, the mitigation options are limited and blunt.
Immediate actions for any NetScaler operator:
- Isolate or power off internet-facing appliances. If the appliance does not need to be internet-facing, move it behind a VPN or restrict access to a known IP allowlist. If you cannot isolate it, powering it off is the safest option. Some administrators have already done this, as The Hacker News reported.
- Block internet access to the management interface. Citrix's own guidance states that NetScaler Management Services should never be exposed to the public internet. This is baseline hygiene that too many deployments violate.
- Disable DTLS. Users in community threads suggested disabling DTLS and watching logs as a stopgap for teams that cannot go offline entirely, per the Cyber Kendra report.
- Restrict to employee IP allowlists only. If you must keep the appliance online, block all internet access and allow only a temporary list of employee addresses.
If you suspect compromise, Citrix's incident response guidance is specific. First, preserve evidence: take a snapshot of any VPX instance, collect logs from remote syslog servers and NetScaler Console, generate a technical support bundle, and capture a core dump of the packet engine. Second, isolate the appliance from the network. Third, change every service account password and secret stored on the appliance, reset passwords of all users who authenticated through it, and revoke its certificates and private keys. Fourth, keep the management interface off the internet permanently.
The Dutch agency's 2025 check scripts, which cover live appliances, core dumps, and full NetScaler images, are a further forensic option with limits. Because the exploitation, as watchTowr describes it, happened before any fix existed, installing the eventual patch will not tell you whether an attacker got in first. You must assume persistence and hunt for it.
For broader context on why edge devices keep landing on the exploit list, our CISA KEV edge gear guide covers the pattern of perimeter device targeting that has accelerated throughout 2026. The earlier Citrix NetScaler RCE exploitation that CISA put on a Saturday deadline is the same product line, same attack surface, same weekend fire drill. And the Citrix Bleed ransomware guide shows what happens when NetScaler exploitation goes unaddressed: identity theft and ransomware follow.
How does this fit the broader exploitation wave?
The NetScaler zero-days did not arrive in isolation. The disclosure sits within a 48-hour exploitation wave across PeopleSoft, SharePoint, WSO2, MikroTik, and WordPress. This is consistent with the pattern threat intelligence teams have tracked all year: attackers are chaining recently disclosed or unpatched flaws across multiple perimeter and web application platforms to maximize access before defenders can respond.
SharePoint alone has driven multiple urgent patch cycles. Our coverage of SharePoint CVE-2026-55040 documented auth bypass exploitation after a proof-of-concept went public, and the SharePoint machine key theft guide showed how RCE can persist even after patching. Add NetScaler to that list and the picture is clear: every major perimeter platform is under simultaneous pressure.
The pattern for operators is brutal. Each disclosure arrives with a different urgency, a different patch availability timeline, and a different set of preconditions. When the patch does not exist yet, as with these NetScaler zero-days, the only control you have is network architecture.
The weekend call
The hardest part of this disclosure is the uncertainty. You do not know which builds are affected. You do not know which configurations are in scope. You do not have IOCs to hunt for. You do not have a patch to install. What you have is a security firm saying two RCE flaws are being exploited on appliances like yours, and a vendor who has not yet confirmed it.
The operators who took their appliances offline on Saturday made a defensible call. The ones who waited, hoping the August patch was enough, are gambling without knowing the odds. By Monday, Citrix may publish an advisory and a fix. But exploitation before a patch means the question extends beyond whether you can patch on Monday. Someone may already have gotten in on Friday.
Treat every internet-facing NetScaler as potentially compromised. Isolate first, preserve evidence, and let the forensics sort out what happened. You can always bring a clean appliance back online. You cannot un-exfiltrate the credentials and keys that passed through a compromised one.
Sources
- The Hacker News: Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
- Cyber Kendra: NetScaler Shutdowns Spread Over Unconfirmed RCE Warning
- Citrix Support: NetScaler ADC and NetScaler Gateway Security Bulletin CTX696939
- Cyber Security Agency of Singapore: Active Exploitation of Vulnerability in NetScaler ADC and NetScaler Gateway
- Canadian Centre for Cyber Security: AL26-019 Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway
