Attackers are actively exploiting two unpatched Citrix NetScaler zero-day vulnerabilities, according to reports from cybersecurity agencies, security researchers, and IT service providers who have begun privately notifying organizations of the threat ahead of expected patches in the coming week.

The situation first surfaced publicly when NetScaler administrators posted on Reddit describing calls from their IT suppliers' security teams urging immediate shutdown of their appliances. Several administrators also reported receiving direct contact from law enforcement, national CERTs, and government cybersecurity agencies about the issue.

We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately

NetScaler administrator on Reddit

Security firm watchTowr confirmed the threat, stating it was "rapidly reacting to rumors" of multiple unpatched NetScaler remote code execution vulnerabilities circulating in active attacks. The firm verified the information with authoritative sources before going public.

We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible

watchTowr

watchTowr clarified that this incident involves separate vulnerabilities distinct from CVE-2026-19490 and CVE-2026-19489, two NetScaler flaws that Citrix disclosed in August. The earlier CVE-2026-19490, an authentication bypass affecting certain NetScaler configurations, entered CISA's Known Exploited Vulnerabilities catalog on September 9 after a proof-of-concept exploit became public.

Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics.

watchTowr

Dutch cybersecurity agency provides technical context

The Dutch National Cyber Security Center (NCSC-NL) distributed a pre-notification advisory to Netherlands-based organizations with additional technical information about the vulnerabilities. Multiple copies of the notice appeared online, revealing that the agency received information from a European partner CERT regarding two critical zero-day flaws in NetScaler.

According to the advisory, each vulnerability independently enables remote code execution. One flaw permits attackers to inject shellcode directly into memory, while technical analysis of the second vulnerability was still underway at the time of notification. No CVE identifiers had been assigned, and Citrix had not published an official advisory, though patches were expected early the following week.

Citrix identified the vulnerabilities during incident response work in customer environments, discovering active exploitation in progress. The company subsequently filed a notification under the European Union's Cyber Resilience Act. The NCSC advisory indicated that exploitation had been confirmed across multiple Citrix customers globally, though the scope of widespread exploitation remained unclear.

The NCSC warned that exploitation attempts could intensify once Citrix releases patches and technical details. Given that NetScaler updates can trigger downtime, the pre-notification aimed to provide organizations time to prepare protective measures and deploy patches rapidly upon release.

As part of our role as the National CSIRT and sectoral CSIRT for designated organizations, the NCSC-NL monitors relevant developments and cyber threats affecting the Netherlands 24/7. We provide information and advice to organizations so that they can take appropriate measures. As you're not part of our constituency, we cannot disclose any further information at this time.

NCSC-NL to BleepingComputer

Interim mitigation guidance

Citrix has not officially disclosed the vulnerabilities, and no public CVE identifiers, affected version lists, indicators of compromise, or official mitigation guidance currently exist. Until Citrix releases patches or formal guidance, administrators should take Internet-facing NetScaler appliances offline where operationally feasible, or limit access to trusted networks and IP ranges to minimize exposure.

  • Take Internet-exposed NetScaler appliances offline where possible
  • Restrict access to trusted networks and IP addresses
  • Do not expose NetScaler management interfaces to the Internet
  • Limit management interface access to trusted IP addresses only