Securify

Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances are being actively exploited in the wild, and there is currently no patch available. The flaws, disclosed publicly by security firm watchTowr on September 26, allow unauthenticated attackers to achieve remote code execution on some of the most critical infrastructure sitting at enterprise network perimeters. Organizations worldwide are being urged to take affected appliances offline immediately.

What Happened

The crisis began unfolding on September 25 when a post on Reddit’s r/Citrix forum referenced a warning from the Dutch National Cyber Security Centre (NCSC-NL), distributed under the restrictive TLP:AMBER+STRICT classification. Within 24 hours, watchTowr confirmed the existence of two distinct, unpatched RCE flaws being used in real-world attacks against Citrix customers. Security researcher Kevin Beaumont corroborated that the vulnerabilities were “being used in active attacks.”

Citrix itself discovered the flaws during forensic investigations of compromised customer environments — meaning attackers were exploiting them before anyone on the defending side knew they existed. As of September 27, Citrix has not published a formal security bulletin, has not assigned CVE identifiers, and has released no patches. The company is expected to issue patches “early in the week of September 28,” according to watchTowr.

How the Attack Chain Works

The two vulnerabilities can be chained together for devastating effect. Both are pre-authentication, meaning an attacker needs nothing more than HTTPS access to a target appliance — no credentials, no user interaction, no insider access.

The first primitive is a heap buffer overflow in NetScaler’s Packet Processing Engine (nsppe). An attacker sends malformed, pipelined HTTP/2 frames containing overlapping header block fragments. The parser fails to verify that the accumulated data length stays within the fixed-size 64KB session receive buffer, resulting in memory corruption.

The second primitive leverages the corrupted memory state to hijack control flow. Through a pointer dereference combined with an ASLR bypass, the attacker overwrites dispatch function pointers, redirecting execution to injected shellcode. The code runs under elevated service privileges within the appliance’s packet processing kernel — essentially giving the attacker root-level control.

These vulnerabilities are entirely separate from CVE-2026-19490 and CVE-2026-19489, which Citrix patched in August 2026. Organizations that applied those earlier patches are not protected against this new attack chain.

Why It Matters

NetScaler appliances are not back-office tools. They sit directly on the public internet perimeter, serving as VPN gateways, load balancers, and authentication brokers for enterprises, healthcare systems, government agencies, and critical infrastructure operators. A compromised NetScaler gives an attacker a foothold at the most privileged point in the network — upstream of firewalls, inside the authentication layer, with visibility into every user session flowing through it.

The post-compromise playbook observed in these attacks is sophisticated. Attackers are injecting in-memory backdoors into running OS daemons to avoid leaving disk artifacts. They are harvesting active AAA session tokens, Kerberos tickets, and plaintext VPN credentials in real time. For persistence, they are modifying startup scripts like /flash/nsconfig/rc.netscaler and cron jobs to survive reboots.

Citrix NetScaler has a long history as a high-value target. CISA’s Known Exploited Vulnerabilities catalog already lists 13 NetScaler entries, and roughly two-thirds of historical NetScaler exploitation has involved advanced persistent threat (APT) groups. The notorious CitrixBleed vulnerability (CVE-2023-4966) demonstrated how a single NetScaler flaw can cascade into mass compromise — and this time, there are two chainable zero-days with no fix available.

Who Is Affected

The full scope of affected versions remains unclear because Citrix has not published an advisory. What is known is that both NetScaler ADC and NetScaler Gateway are impacted. Notably, version 13.1 reached End of Maintenance on September 15 — just 11 days before the zero-days became public — raising questions about whether organizations still running that branch will receive patches at all. Whether the most current builds (14.1-73.32 and 13.1-63.21 from August) are vulnerable has not been confirmed by Citrix.

The scale of potential exposure is significant. NetScaler appliances are deployed across Fortune 500 companies, government agencies, healthcare networks, and financial institutions globally. Any organization with an internet-facing NetScaler instance is a potential target.

What You Should Do Now

With no patches available, defenders are left with blunt but necessary options. Based on guidance from NCSC-NL, watchTowr, and Citrix’s existing compromise response documentation, organizations should consider the following immediate actions:

Take internet-exposed appliances offline if operationally feasible. Several organizations have already done so. If a full shutdown is not possible, restrict access to trusted networks and IP addresses only. Management interfaces should never be exposed to the public internet.

Hunt for signs of compromise. Inspect for unauthorized shell processes spawned by the nsppe process, modifications to startup scripts and cron jobs, new or modified files in /netscaler/ns_gui/ and /var/netscaler/gui/, and core dumps in /var/crash/. The Dutch NCSC published check scripts on GitHub in 2025 that can assess compromise indicators on live appliances.

Preserve forensic evidence before making changes. Take snapshots, collect logs and support bundles, and isolate affected systems from the network. Reset all service account credentials and revoke certificates and private keys associated with the appliances.

Monitor for the patch. When Citrix releases the fix (expected early this coming week), apply it immediately — but understand that patching alone will not confirm whether a system was previously compromised. Post-patch forensic review will still be necessary.

What to Watch Next

The coming days will be critical. Citrix’s official advisory and CVE assignments will clarify which versions are vulnerable and provide formal mitigation guidance. Once a patch drops, the clock starts ticking in the other direction — reverse engineers will analyze the fix to develop proof-of-concept exploits, likely within hours, accelerating attacks against unpatched systems.

The broader pattern here is hard to ignore. Network edge appliances from Citrix, Ivanti, Palo Alto, and Fortinet have become the preferred entry point for sophisticated threat actors, and the gap between zero-day discovery and patch availability continues to leave defenders exposed. For now, the safest assumption is that any internet-facing NetScaler may already be compromised — and should be treated accordingly.