Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
Two unpatched Citrix NetScaler zero-days enabling remote code execution are reportedly under active attack, with no vendor patch.
Tenable's Research Special Operations team published an FAQ on two reported Citrix NetScaler zero-days that can enable remote code execution. As of September 27, 2026, neither flaw has a CVE, and Citrix has not issued an advisory or patches. watchTowr and Kevin Beaumont say the bugs are used in active attacks, though widespread scale is unconfirmed. The issues are unrelated to patched CVE-2026-19490 and CVE-2026-19489; reports began with a September 25 Reddit post citing a restricted NCSC-NL pre-notification.
- Two unpatched NetScaler zero-days reportedly allow remote code execution.
- Reports cite an NCSC-NL TLP:AMBER+STRICT pre-notification, not a Citrix advisory.
- watchTowr and Kevin Beaumont say attacks are active and no patch exists.
- Flaws are unrelated to patched CVE-2026-19490 and CVE-2026-19489.
- Citrix had published no formal advisory as of September 27, 2026.
- CVEs
- CVE-2026-19490CVE-2026-19489CVE-2026-8452CVE-2026-3055CVE-2025-7775CVE-2025-5777CVE-2025-6543CVE-2023-6549CVE-2023-6548CVE-2023-4966CVE-2023-3519CVE-2020-8193CVE-2019-19781
- Vendors
- Citrix
- Countries
- NetherlandsUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2020-8193 | Unauthenticated Authorization Bypass in Citrix ADC, Gateway, and SD-WAN WANOP | 6.5 | 88% | KEVPoC | KEV |
| CVE-2023-3519 | Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway | 7.5 | 100% | KEVRansomware | KEV |
CVE-2023-6548+1 related CVE | Authenticated Code-Injection RCE in Citrix NetScaler ADC/Gateway | 8.8 group max | 3% | KEV | KEV |
| CVE-2025-5777 | Out-of-Bounds Read (Memory Overread) in Citrix NetScaler ADC and Gateway | 9.3 | 100% | KEVRansomware | KEV |
| CVE-2025-6543 | Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild | 9.2 | 10% | KEV | KEV |
| CVE-2025-7775 | Actively Exploited Memory Overflow RCE/DoS in Citrix NetScaler ADC/Gateway | 9.2 | 21% | KEV | KEV |
| CVE-2026-19489 | Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway | 8.8 | <1% | ||
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
From the original article
5 min read at tenable.com
There are reportedly two unpatched zero-day Citrix NetScaler vulnerabilities capable of enabling remote code execution that have been actively exploited in the wild, with no patches available at this time. Key takeaways Reports indicate that there are two critical zero-day vulnerabilities in Citrix NetScaler.
By Satnam Narang · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.