Two Unpatched Citrix NetScaler Zero-Day RCE Vulnerabilities Actively Exploited

On September 26, watchTowr disclosed the existence of two previously unknown remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway products. At the time of the disclosure, Citrix had neither acknowledged the vulnerabilities nor released patches. The critical detail is that active exploitation was already underway in real networks, meaning attackers had already weaponized these flaws before public awareness. This compressed timeline between discovery, disclosure and active abuse is a hallmark of zero-day scenarios where defenders have almost no preparation time.

The fact that some administrators immediately took their appliances offline, rather than waiting for a fix, signals how serious the threat was perceived. NetScaler products are often deployed as critical perimeter infrastructure, sitting between external networks and sensitive internal systems. An attacker who gains code execution on these appliances can pivot to internal networks, capture credentials, or establish persistent access.

Citrix NetScaler ADC (Application Delivery Controller) and NetScaler Gateway are load balancers and remote access gateways used by thousands of organizations worldwide, including government agencies, financial institutions and healthcare providers. These appliances typically handle encrypted traffic, authenticate users and route requests to backend systems. They are often among the first things an attacker encounters when scanning a target network.

Because they are positioned at the network edge, they are both exposed to the internet and trusted by internal systems. A successful attack that achieves remote code execution on a NetScaler appliance gives an attacker a foothold inside the network perimeter, often with elevated privileges. The appliance can be used to eavesdrop on traffic, inject malicious content, move laterally to other systems or exfiltrate data.

A zero-day vulnerability is one that has been discovered by attackers but has not yet been patched by the vendor. During the window between discovery and the availability of a fix, defenders have no official mitigation. Attackers who hold the exploit code have a significant advantage: they can target organizations that do not yet know they are vulnerable.

In this case, watchTowr detected active exploitation, meaning attackers were already using these flaws against real targets. This is not theoretical research or a proof-of-concept; real damage was being done. Organizations running affected versions had three bad choices: keep systems online and hope they were not being targeted, take systems offline and disrupt business, or attempt manual workarounds of unknown effectiveness.

If you operate Citrix NetScaler appliances, here are the actions to take without delay:

1. Check your current NetScaler firmware version and product variant (ADC, Gateway, or both) against the affected versions listed in official Citrix advisories.

1. Monitor Citrix's official security advisory pages and social media accounts for patch availability; do not rely on third-party summaries or news outlets alone.

1. If you are running an affected version and cannot patch immediately, implement network segmentation to restrict who can access the NetScaler appliance from outside your organization.

1. Review access logs on your NetScaler appliances for signs of exploitation attempts or unusual traffic patterns; capture these logs for incident response if needed.

1. If your organization has a vulnerability management or security operations team, escalate this to them immediately with the CVE identifiers (once assigned) or watchTowr's technical details.

1. Consider whether taking the appliance offline temporarily is feasible; this is the most certain protection while patches are unavailable.

At the time watchTowr went public, Citrix had not issued a statement acknowledging the vulnerabilities, let alone releasing patches. This silence is frustrating for defenders but not uncommon in the early stages of a zero-day incident. Vendors often take time to confirm the issue, develop a fix, test it and prepare release notes and guidance for customers. During this window, organizations are on their own.

The decision to disclose a zero-day while it is actively being exploited, even before patches are available, is a judgment call. watchTowr chose transparency: letting defenders know they are under attack and giving them the information they need to respond, rather than sitting on the information and hoping Citrix would move faster. This approach puts the burden on defenders but aligns with the principle that more information is better than secrecy when lives or critical systems are at risk.

This incident reinforces several uncomfortable truths about critical infrastructure defense. First, vendor patches are not always available immediately, and waiting for them is not always an option. Organizations operating critical appliances need backup plans: air-gapped testing environments, the ability to roll back quickly, and processes for partial or temporary degradation of service.

Second, perimeter appliances like NetScaler are attractive targets because they are both exposed and privileged. Deploying them should include multi-layered monitoring, access control and network segmentation. Do not assume that sitting behind a firewall makes them safe; many organizations have been compromised through appliance vulnerabilities that turned out to be less well-protected than assumed.

Third, following security mailing lists and vendor advisories directly, rather than hearing about threats through news outlets, can provide a critical hours or days of extra warning. By the time a zero-day appears in the news, it may already be actively exploited.

If you manage infrastructure, treat this as an active threat to your organization, not an abstract news story. Check what version of Citrix NetScaler you are running right now, confirm it against Citrix's official list of affected products, and decide on a response that balances your tolerance for service disruption against your exposure to compromise. If you cannot patch, make the architecture changes needed to reduce access to the appliance. If you can patch, watch for Citrix to publish fixes and test them immediately. Do not assume someone else is monitoring this for you.