Story · 2 sources · 2 articlesfirst Sep 27, 04:07 UTCupdated Sep 27, 07:47 UTC (2h ago)

Unpatched Citrix NetScaler RCE Zero-Days Reportedly Exploited

criticalExploit / PoCexploited in the wildimportance 88CVE-2026-19490 CVE-2026-19489

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

watchTowr says two unpatched Citrix NetScaler RCE flaws are exploited, but Citrix has not confirmed or patched them.

watchTowr said on September 26 that two unpatched remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway are zero-days found during forensic work and exploited in the wild. Citrix had not confirmed the bugs or issued CVE identifiers, affected-build details, indicators, a workaround, an advisory, or a fix; watchTowr expects vendor communications early in the week of September 28. One report describes the exploitation as alleged, while the other says the flaws are under active exploitation, though both agree Citrix has not confirmed them. The reports say the issues are separate from August flaws CVE-2026-19490, a CVSS 9.3 authentication bypass patched on August 19 and added to CISA’s KEV catalog on September 9, and, according to one source, CVE-2026-19489, a CVSS 8.8 memory-overflow issue. No victims have been named. Defenders are urged to inventory exposure, restrict management access, and preserve logs, and some administrators have powered appliances off; NetScaler 13.1 reached end of maintenance on September 15, 2026.

watchTowr said on September 26 that two unpatched remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway were found during forensic work and are reportedly exploited in the wild.
Citrix has not confirmed the flaws and has not published CVE identifiers, affected builds, indicators of compromise, a workaround, an advisory, or a patch.
Sources differ on certainty: one calls the exploitation alleged, while the other says the flaws are under active exploitation; both say Citrix has not confirmed them.
The issues are distinct from CVE-2026-19490, a CVSS 9.3 authentication bypass patched on August 19 and added to CISA’s KEV catalog on September 9, and, per one report, CVE-2026-19489, a CVSS 8.8 memory-overflow issue.
No victims have been named; watchTowr expects Citrix communications early in the week of September 28.
Defenders are urged to inventory exposed appliances, restrict management access, preserve logs, and isolate systems if residual risk is unacceptable; some administrators have powered appliances off.
NetScaler 13.1 reached end of maintenance on September 15, 2026.

VendorsCitrix Cloud Software Group

ProductsNetScaler ADC NetScaler Gateway NetScaler

OrganizationsCISA National Cyber Security Centre watchTowr Cyber Security Agency of Singapore Canadian Centre for Cyber Security

CountriesNetherlands Singapore Canada

Coverage timelineoldest first · each row is one article

04:07 UTC · 6h ago
Cyber Security News· 82
Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks
watchTowr warns two unpatched Citrix NetScaler RCE zero-days are allegedly exploited, without Citrix confirmation.
07:47 UTC · 2h ago
The Hacker News· 88
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
watchTowr says two unpatched Citrix NetScaler remote code execution zero-days are under active exploitation.

Vulnerabilities in this storyAll →

CVE-2026-194898.8<1%
Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
published Aug 19, 2026· Citrix NetScaler ADC (formerly Citrix ADC)
CVE-2026-194909.37%
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-19489	Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway CVE-2026-19489 is a vulnerability in Citrix NetScaler ADC and NetScaler Gateway classified as a classic buffer overflow (CWE-120), meaning input is copied into a buffer without adequate size checks; it was disclosed by Citrix alongside CVE-2026-19490, the authentication bypass receiving most of the headline attention. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), the flaw is reachable over the network by an unauthenticated remote attacker with no user interaction, though detailed trigger conditions are not spelled out in the CVE description. The scoring (VC:L/VI:L/VA:H, base 8.8 High) indicates the primary impact is to availability — likely crashes or denial of service on the appliance — with low confidentiality and integrity impact. All organizations running NetScaler ADC or NetScaler Gateway 14.1 releases through build 73.32, or 13.1 releases through build 63.21, fall within the affected ranges. There is no evidence of exploitation so far: the issue is not in CISA KEV, has no known public proof-of-concept, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days (32nd percentile). Do: Upgrade affected NetScaler ADC and NetScaler Gateway deployments to the fixed builds identified in Citrix's advisory (see AL26-019 and CISA advisory AV26-833 Update 1); affected ranges are 14.1 through build 73.32 and 13.1 through build 63.21. Until patched, limit internet exposure of appliance interfaces and monitor Citrix channels for signs of exploitation. Also verify whether the same appliances are affected by the related CVE-2026-19490 authentication bypass fixed in the same advisory.	8.8	<1%		Citrix NetScaler ADC (formerly Citrix ADC) 14.1 releases through build 73.32; 13.1 releases through build 63.21 Citrix NetScaler Gateway (formerly Citrix Gateway) 14.1 releases through build 73.32; 13.1 releases through build 63.21	mass≈100,000+ internet-exposed NetScaler ADC/Gateway appliances (order-of-magnitude estimate; not all run affected builds)	Aug 19, 2026
CVE-2026-19490	Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile). Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.	9.3	7%	KEV PoC

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-19489

Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19489 is a vulnerability in Citrix NetScaler ADC and NetScaler Gateway classified as a classic buffer overflow (CWE-120), meaning input is copied into a buffer without adequate size checks; it was disclosed by Citrix alongside CVE-2026-19490, the authentication bypass receiving most of the headline attention. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), the flaw is reachable over the network by an unauthenticated remote attacker with no user interaction, though detailed trigger conditions are not spelled out in the CVE description. The scoring (VC:L/VI:L/VA:H, base 8.8 High) indicates the primary impact is to availability — likely crashes or denial of service on the appliance — with low confidentiality and integrity impact. All organizations running NetScaler ADC or NetScaler Gateway 14.1 releases through build 73.32, or 13.1 releases through build 63.21, fall within the affected ranges. There is no evidence of exploitation so far: the issue is not in CISA KEV, has no known public proof-of-concept, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days (32nd percentile).

Do: Upgrade affected NetScaler ADC and NetScaler Gateway deployments to the fixed builds identified in Citrix's advisory (see AL26-019 and CISA advisory AV26-833 Update 1); affected ranges are 14.1 through build 73.32 and 13.1 through build 63.21. Until patched, limit internet exposure of appliance interfaces and monitor Citrix channels for signs of exploitation. Also verify whether the same appliances are affected by the related CVE-2026-19490 authentication bypass fixed in the same advisory.

8.8

<1%

Citrix NetScaler ADC (formerly Citrix ADC) 14.1 releases through build 73.32; 13.1 releases through build 63.21
Citrix NetScaler Gateway (formerly Citrix Gateway) 14.1 releases through build 73.32; 13.1 releases through build 63.21

mass≈100,000+ internet-exposed NetScaler ADC/Gateway appliances (order-of-magnitude estimate; not all run affected builds)

Aug 19, 2026

CVE-2026-19490

Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).

Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.

9.3

KEV PoC