Published Sunday, September 27, 2026 at 11:52 AM PT
BLUF: Two unpatched remote code execution zero-day vulnerabilities in Citrix NetScaler are actively exploited in the wild with no patches available. Any organization operating NetScaler appliances is at immediate risk. Inventory deployments now and implement network isolation where possible pending patch release.
DETAILS
- Two high-severity RCE vulnerabilities confirmed by Citrix — both capable of remote code execution; CVE identifiers not yet specified in available reporting.
- Active exploitation confirmed — multiple independent security sources (BleepingComputer, SecurityAffairs, The Hacker News, Tenable) report ongoing attacks in the wild; no patch release date announced as of this alert.
- No mitigation patches available — Citrix has not released fixes; timeline for patches is unconfirmed.
- CISA directive to government agencies — Cybersecurity and Infrastructure Security Agency has urged federal agencies to immediately patch/defend; implies critical infrastructure targeting.
- Initial attack surface unknown but broad — reporting does not specify whether exploitation requires authenticated access or is unauthenticated; scope of affected NetScaler versions not detailed in available summaries.
IMPACT
- All NetScaler operators are potential targets — scope includes private sector, government, and critical infrastructure.
- Complete system compromise possible — remote code execution allows attackers to execute arbitrary commands with NetScaler process privileges; potential for lateral movement into protected networks behind the appliance.
- Active threat environment — exploitation is occurring now, not theoretical; attackers are actively leveraging these flaws against live deployments.
RECOMMENDED ACTIONS
- Immediate inventory — identify all Citrix NetScaler instances, versions, and network roles in your environment.
- Network isolation — segment NetScaler appliances from sensitive systems if operationally feasible; restrict inbound access to only required administrative users/networks.
- Increase monitoring — enable debug/verbose logging on NetScaler; alert on unexpected code execution, shell spawning, or lateral movement originating from the appliance.
- Monitor Citrix security advisories hourly — patch release is imminent given CISA involvement; be ready to deploy within hours of availability.
- Prepare alternate access paths — if NetScaler is your primary remote access point, identify and test backups in case appliance must be isolated/rebuilt.
SOURCES
Tenable Blog; Citrix Security Advisory; BleepingComputer; SecurityAffairs; The Hacker News; SecurityWeek; CISA public guidance.
Recent high-severity events at publish time:
