Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Security firm watchTowr disclosed on September 26 that two previously unknown remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited, with no patch currently available from Citrix. The firm says both flaws were abused before any fix existed, were uncovered through forensic investigations, and are distinct from the already-patched authentication bypass CVE-2026-19490 fixed on August 19. Citrix has not confirmed the issues, released an advisory, or indicated whether current builds such as 14.1-73.32 and 13.1-63.21 are affected, and watchTowr expects official communication and patches sometime during the week of September 28. In the meantime, some administrators report being told by their security teams to take NetScaler appliances offline entirely, since these edge devices manage VPN access, authentication and load balancing for many organizations, and installing a future patch would not reveal whether attackers already gained persistent access beforehand.