Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
watchTowr says two unpatched Citrix NetScaler remote code execution zero-days are under active exploitation.
watchTowr said on September 26 that two unpatched remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway are being exploited in the wild. Citrix has not confirmed the bugs or shipped a fix, and some administrators have powered appliances off. The flaws are separate from CVE-2026-19490, an authentication bypass patched on August 19 and added to CISA's KEV catalog on September 9. No victim, indicators, or workaround has been published; watchTowr expects Citrix communications early in the week of September 28.
- Two unpatched NetScaler ADC and Gateway RCE flaws are reportedly exploited.
- Citrix has not confirmed the flaws or published patches or IoCs.
- Issues are distinct from the patched bypass CVE-2026-19490.
- No indicators of compromise or vendor workaround have been published.
- NetScaler 13.1 hit end of maintenance on September 15, 2026.
- CVEs
- CVE-2026-19490
- Vendors
- CitrixCloud Software Group
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISANational Cyber Security CentrewatchTowr
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
From the original article
3 min read at thehackernews.com
Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one to be available.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.