Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks
watchTowr warns two unpatched Citrix NetScaler RCE zero-days are allegedly exploited, without Citrix confirmation.
watchTowr says two undisclosed Citrix NetScaler remote code execution flaws are unpatched zero-days found during forensic work and allegedly exploited in the wild. Citrix had not issued CVE identifiers, affected-build details, indicators, or an advisory at publication time. The report is separate from Citrix’s August bulletin on CVE-2026-19490, a CVSS 9.3 authentication bypass already added to CISA’s KEV catalog, and CVE-2026-19489, an 8.8 memory-overflow issue. Until clarification, defenders are advised to inventory exposed appliances, restrict management access, preserve logs, and isolate systems if residual risk is unacceptable.
- watchTowr reports two unpatched NetScaler RCE zero-days found in forensic investigations.
- Citrix has published no CVE, affected builds, indicators, or advisory for the new flaws.
- Reports are distinct from August flaws CVE-2026-19490 and CVE-2026-19489.
- CVE-2026-19490, an auth bypass rated 9.3, is already in CISA’s KEV catalog.
- Defenders are urged to inventory exposure, preserve evidence, and isolate appliances if needed.
- Vendors
- Citrix
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19489 | Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway | 8.8 | <1% | ||
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
From the original article
3 min read at cybersecuritynews.com
Citrix NetScaler administrators are confronting reports of two undisclosed remote code execution vulnerabilities allegedly exploited in real-world attacks. watchTowr said the flaws are unpatched zero-days, were identified during forensic investigations, and that Citrix communications and fixes are expected early next week.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.