Safety alert: two CERs without patch in Citrix NetScaler, active operation according to watchTowr

On September 26, the security firm watchTowr reported that there are two zero- day-free vulnerabilities in the Citrix NetScaler ADC and NetScaler Gateway applications that allow remote code execution (CERs) and that, according to that company, they are being actively exploited in productive environments. Citrix has not published any newsletter or publicly confirmed these judgements, and the pieces available to the public do not contain commitment indicators or forensic evidence provided by watchTowr. Therefore, what can be said with certainty is limited: a security company warned about ongoing exploitation; Citrix has not issued a patch or official details; and some administrators have decided to remove devices from the network while waiting for a solution.

What are NetScaler ADC and NetScaler Gateway and why they matter. These applications (physical or virtual) act on the perimeter of many companies as load balers, remote access controllers and VPN and authentication completion points. A NetScaler commitment at the network border can give an attacker the ability to intercept or redirect traffic, extract credentials and maintain persistent access to domestic remedies. This critical function is the reason why the CERs alerts in these teams are especially serious: it is not an any server, but a component that regulates who enters and leaves a corporate network.

What is known and what is not. Confirmed: watchTowr published on X (before Twitter) an initial note on September 26 and a follow-up in which he stated that there are two CERs without patch and that the operation precedes any correction of the supplier. Citrix, for his part, has not announced anything publicly until the morning of the Sunday following the alert. Not confirmed: exact versions affected, operating vectors, commitment indicators (IoC), specific victims, or the forensic source that would have discovered the intrusions. There is also no Citrix newsletter at this time that details which buildings receive correction or whether versions that have already reached the end of maintenance will receive patches.

Recent context and why the situation is complex. In August Citrix corrected an authentication bypass (mentioned as CVE-2026-19490 in several reports) and that correction was already included by agencies such as CISA in its catalogue of freely exploited vulnerabilities; in addition, in previous months, there have been documented cases in which parcheed bugs led to the exploitation of CERs through vectors such as heap overruns. This shows that the chain of vulnerabilities and the holdings against NetScaler has been active in recent months, and that previous incidents have led some administrators to choose to turn off or isolate devices in the absence of official instructions. For reference to the list of exploited vulnerabilities, see the CISA page: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog. For the official Citrix ad page, see https: / / support.citrix.com /.

How an CERs could work technically on NetScaler. Although there are no public details of the two failures cited by watchTowr, an CERs in such an application usually takes advantage of an exposed service (web management interface, REST API, SSL / TLS proxy, or package processing components) to run arbitrary code in the application operating system or in privileged processes. An attacker with CERs can run commands with high privileges, install persistence (backdoors, cron jobs, webshells), extract private keys and stored credentials, or pivote into the internal network. This is why the pre-patch operation makes the mere subsequent update not necessarily eliminate the presence of an attacker: persistencies installed before the patch will remain active until they are detected and eliminated.

Who it affects. To organisations using NetScaler ADC or NetScaler Gateway exposed to public networks or allowing remote access to management. In particular, environments that depend on these applications for corporate VPN or user authentication are at high risk because the exploitation could provide direct access to internal sessions and resources. Suppliers and MSSP that manage these third-party equipment are also affected by the potential multiplier effect.

Actual and likely consequences. If the operation achieves CERs with high privileges, the consequences include: unauthorized access to internal networks; capture or supplanting VPN sessions; theft of credentials and certificates; persistence of the attacker who survives patches; and potential impact on availability (deliberate interruptions or incidents by defensive responses). Since there is no public IoC, many organizations must assume that a compromise could be silent and prior to any patch, which complicates containment.

Immediate and concrete measures to be taken by the reader. First, act with priority and in a planned way: contact your security team and supplier (Citrix TAC or reseller) and document each step. As long as there is no official patch, consider these practical actions: 1) Preserve evidence before turning off: if possible, generate VPX snapshots, capture technical support (support bundle), preserve syslog records and make package engine core braindumps, following the manufacturer's guides; 2) If you suspect active commitment and imminent risk, isolate the application of the network or turn it off - but take into account that shutdown destroys volatile devices; 3) Change all service account and secret passwords stored in the application, revoke certificates and private keys if there is reasonable suspicion of exposure; 4) Remove the public Internet management interface and limit administrative access to internal management networks and VPN with MFA; 5) Apply intensive monitoring: review authentication logs, incoming connections, and file transfers; 6) Consider reconstructing or reinstalling the application from clean images if there is a sign of persistence; 7) Run, when applicable, the check scripts and recommendations of recognized agencies - for example, the Netherlands NCSC offered in previous incidents utilities and procedures to check images and core braindumps (see the agency portal: https: / / www.ncsc.nl / english); 8) Maintain a communication channel with your supplier and document everything for possible forensic and legal processes.

Decide to switch off, isolate or keep in service. There is no single response: turning off prevents further immediate exploitation but removes volatile forensic evidence; isolating the device into a laboratory or containment network allows for analysis without cutting the traceability; keeping it in service keeps it available but expands the exposure window. If your NetScaler guarantees critical access and cannot be replaced fast, the decision must balance security, availability and forensic capacity.

What to expect from the manufacturer and the calendar. WatchTowr indicated that he expected communications and Citrix patches in the week of 28 September; until Citrix publishes an official newsletter there are no IOCs or authorized mitigation. In addition, some product lines (e.g. NetScaler 13.1) have recently reached the maintenance end, which may complicate the availability of patches for old versions. It is reasonable to prepare to implement updates in compatible systems and plan migration if your version is no longer maintained.

In short, there is a consistent warning of active exploitation on NetScaler according to a security firm, but there are no public technical confirmations and Citrix patches. Meanwhile, take high risk for exposed applications, prioritize the preservation of evidence and isolation, change passwords and committed certificates, and keep in mind the official Citrix releases and vulnerability lists managed by agencies such as CISA. To closely monitor the updates, see the Citrix security page and the CISA catalog.