Skip to navigation

Threat reportVulnerabilityTL-2026-2682

Citrix NetScaler: Two Unpatched Zero-Day RCE Flaws Allegedly Exploited in the Wild (watchTowr Forensic Alert)

highACTIVE

watchTowr says it identified two separate, unpatched remote code execution vulnerabilities in Citrix NetScaler during forensic investigations, and that credible reporting indicates both are already being exploited in the wild. No CVE IDs, affected builds, CVSS scores, or IOCs have been published as of 2026-09-27; Citrix has not confirmed the flaws and communications/fixes are expected 'early next week.'

Key facts

IdentifiersTL-2026-2682, CVE-2026-19489, CVE-2026-19490
SeverityHIGH
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-19490 (added )
EPSSCVE-2026-19490: 7.0% (93.9th percentile)
Affected productsCloud Software Group (Citrix) NetScaler ADC; Cloud Software Group (Citrix) NetScaler Gateway; Cloud Software Group (Citrix) NetScaler ADC and NetScaler Gateway (related, already-patched CVE-2026-19489/CVE-2026-19490)
ToolswatchTowr Platform
MITRE ATT&CK techniquesT1059.004 Unix Shell, T1190 Exploit Public-Facing Application, T1212 Exploitation for Credential Access, T1222.002 Linux and Mac Permissions, T1499.004 Application or System Exploitation, T1505.003 Web Shell, T1595.002 Vulnerability Scanning, T1685 Disable or Modify Tools
MotivationUNKNOWN
Target regionsnetherlands, Europe
Detection rules9 (1 shown free)
Sources17 cited sources

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2682 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NetScaler Webshell Drop or SUID Modification on /bin/sh (Post-Exploitation)

Detects file creation of PHP/JSP webshells under the documented NetScaler drop paths (/var/vpn/theme/, /netscaler/ns_gui/, /var/vpn/helpdesk/, /netscaler/portal/) and SUID-bit modification on /bin/sh — the persistence and privilege-escalation artifacts watchTowr documented in the CVE-2026-8452 root-RCE chain, offered here as the best-evidenced proxy for post-exploitation of the unconfirmed 2026-09-26 zero-days.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1505.003, T1222.002, T1068, T1059.004
  • Data sources: netscaler_syslog, linux_auditd, file_integrity_monitoring
  • Severity: critical
  • Confidence: high

Splunk SPL

index=netscaler sourcetype="citrix:netscaler:ns" OR sourcetype="unix:filemon" OR sourcetype="linux:audit"
| eval filepath=coalesce(file_path, path, filename)
| where match(filepath, "(?i)(/var/vpn/theme/|/netscaler/ns_gui/|/var/vpn/helpdesk/|/netscaler/portal/).*\.(php|phtml|jsp)$")
   OR (match(filepath, "^/bin/sh$") AND match(perm_change, "(?i)suid|4755|setuid"))
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(action) as actions, values(user) as actor by host, filepath
| eval alert="Possible NetScaler webshell drop or SUID modification on /bin/sh (post-exploitation, CVE-2026-8452-class chain)"
| table first_seen, last_seen, host, filepath, actions, actor, alert

Microsoft KQL

DeviceFileEvents
| where TimeGenerated > ago(24h)
| where (FolderPath has_any ("/var/vpn/theme/","/netscaler/ns_gui/","/var/vpn/helpdesk/","/netscaler/portal/") and (FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".jsp"))
   or (FolderPath == "/bin" and FileName == "sh" and ActionType in ("FileModified","FilePermissionsChanged"))
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessAccountName, InitiatingProcessCommandLine

Sigma

title: NetScaler Webshell Drop or SUID Modification on /bin/sh
id: 9d4f2c6a-1b3e-4a77-8c5d-2e9a7b4c6f02
status: experimental
description: Detects PHP/JSP webshell files written to known NetScaler web-accessible paths, or a SUID bit set on /bin/sh — the persistence and privilege-escalation artifacts from watchTowr's CVE-2026-8452 root-RCE chain, used as a proxy detection for the unconfirmed 2026-09-26 NetScaler zero-days.
references:
    - https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/
    - https://securityarsenal.com/blog/cve-2026-8452-citrix-netscaler-pre-auth-rce-disclosed-by-watchtowr-detection-hunting-and-remediation-guide
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.privilege-escalation
    - attack.t1222.002
    - attack.t1068
    - attack.tool.webshell
    - cve.2026.8452
logsource:
    category: file_event
    product: linux
detection:
    selection_webshell:
        TargetFilename|contains:
            - '/var/vpn/theme/'
            - '/netscaler/ns_gui/'
            - '/var/vpn/helpdesk/'
            - '/netscaler/portal/'
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.jsp'
    selection_suid:
        TargetFilename: '/bin/sh'
        Mode|contains: '4755'
    condition: selection_webshell or selection_suid
falsepositives:
    - Authorized Citrix administrator theme customization or portal branding change under a tracked change ticket
    - Backup/restore or firmware-update utilities that legitimately reset file permissions on system binaries
level: critical

Known false positives:

  • Authorized Citrix admin file uploads/customization to the ns_gui theme or portal directories during a change window
  • Firmware upgrade or backup/restore utilities that reset permissions on system binaries including /bin/sh

Tuning notes: Allowlist known Citrix admin accounts and approved change-ticket windows for ns_gui/theme customization; scope the webshell rule to file extensions never legitimately deployed by change management; alert on any SUID change to /bin/sh outside a documented firmware-update maintenance window.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • NetScaler Gateway/AAA/SAML Pre-Auth Endpoint Scanning & Exploitation Attempt (Sentinel) · unlock with TL Creds
  • NetScaler Webshell Drop or SUID Modification on /bin/sh (Post-Exploitation, Sentinel) · unlock with TL Creds
  • NetScaler nsppe Crash/Respawn Defense-Impairment or [indicator] Session-Cookie Reuse (Sentinel) · unlock with TL Creds
  • NetScaler Gateway/AAA/SAML Pre-Auth Endpoint Scanning or Exploitation (Sigma) · unlock with TL Creds
  • NetScaler Webshell Drop or SUID Modification on /bin/sh (Sigma) · unlock with TL Creds
  • NetScaler nsppe Crash/Respawn Defense Impairment or [indicator] Session-Cookie Reuse (Sigma) · unlock with TL Creds
  • NetScaler Gateway/AAA/SAML Pre-Auth Endpoint Scanning & Exploitation Attempt · unlock with TL Creds
  • NetScaler nsppe Crash/Respawn Defense-Impairment or [indicator] Session-Cookie Reuse · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-2682.

14 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On 2026-09-26, security firm watchTowr said it was "rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild," characterizing the information as scarce but credible, and confirming that watchTowr Platform clients had already been notified of their NetScaler exposure. watchTowr subsequently stated the intelligence came from forensic (post-breach) investigations and had been verified with authoritative sources, describing two separate, unpatched vulnerabilities capable of remote code execution. watchTowr explicitly clarified that the newly reported flaws are distinct from CVE-2026-19490, the critical NetScaler Gateway/AAA authentication-bypass bug Citrix patched on 2026-08-19 and CISA added to its KEV catalog on 2026-09-09.

The alert triggered widescale confusion. A viral, unsourced post from the account "International Cyber Digest" claimed an unnamed 'critical' NetScaler zero-day was under active exploitation and prompted several governments and organizations to shut down internet-exposed NetScaler appliances immediately, disrupting VPN, ICA proxy, and authentication services. The Dutch National Cyber Security Centre (NCSC-NL) informally notified organizations and advised immediate shutdowns, though as of this writing it had not issued a new public advisory covering these specific unpatched flaws (its most recent published advisory, NCSC-2026-0318, covers the already-known CVE-2026-19489/CVE-2026-19490 pair). Reporting also noted that a considerable share of the panic may actually trace back to continued exploitation of the already-disclosed CVE-2026-19490 rather than the new zero-days, since that flaw has been under active, KEV-listed exploitation since at least 2026-09-03.

As of 2026-09-27, Citrix (Cloud Software Group) has not published CVE identifiers, affected builds, an advisory, technical exploitation details, or indicators of compromise for the two newly reported zero-days; watchTowr itself said it would not publicly disclose exploitation paths, prerequisites, payloads, or forensic artifacts ahead of vendor coordination. Citrix communications and patches are expected 'early next week' (week of 2026-09-28).

This alert lands squarely in watchTowr's established NetScaler research lineage. In mid-2026, watchTowr Labs disclosed CVE-2026-8451, a pre-auth SAML XML-parser memory overread ('CitrixBleed To Infinity And Beyond') that leaked adjacent heap memory and session-cookie (NSC_TASS) contents from the nsppe packet-processing engine, and CVE-2026-8452, a pre-auth heap overflow in SAML SignedInfo/InclusiveNamespaces canonicalization handling that watchTowr escalated from a DoS-only Citrix advisory (CTX696604) into full unauthenticated root RCE — including disabling appliance crash/reboot signal handlers and dropping a PHP webshell with a SUID /bin/sh. CISA added CVE-2026-8452 to its KEV catalog on 2026-08-26 after observing webshells and discovery activity on compromised appliances in the wild. Because Citrix has not yet disclosed the technical root cause of the two new unpatched flaws, this research documents the concrete, sourced exploitation pattern established across NetScaler's recent pre-auth RCE/auth-bypass disclosures (CVE-2026-19489, CVE-2026-19490, CVE-2026-8451, CVE-2026-8452) as the best-evidenced proxy for the exploitation class defenders should hunt for, while treating the two new zero-days themselves as unconfirmed pending Citrix's advisory.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access

defense-impairment

T1222.002 Linux and Mac Permissions; T1685 Disable or Modify Tools

Impact

T1499.004 Application or System Exploitation

Persistence

T1505.003 Web Shell

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

  • Citrix communications and a fix for the two new unpatched RCE zero-days are expected 'early next week' (week of 2026-09-28), per watchTowr; no patch exists as of 2026-09-27
  • CVE-2026-19490 and CVE-2026-19489 are already patched: upgrade to NetScaler ADC/Gateway 14.1-73.32+, 13.1-63.21+, 14.1-73.32 FIPS+, or 13.1-37.277+ (FIPS/NDcPP)
  • CVE-2026-8452 and CVE-2026-8451 are already patched: upgrade to NetScaler ADC/Gateway 14.1-72.61+ or 13.1-63.18+ (and corresponding FIPS/NDcPP builds)

Immediate actions

  • Treat every internet-exposed NetScaler ADC/Gateway appliance as high-risk pending Citrix's advisory; restrict inbound management-interface and Gateway/AAA access to trusted IP ranges where feasible, per Mandiant's standing guidance from prior NetScaler incidents
  • Review authentication, session, and administrative logs for anomalous or unauthenticated access predating any future patch, especially activity since early September 2026
  • Hunt for the post-exploitation artifacts documented across the related, concurrently-disclosed NetScaler RCE chain: unexpected PHP/webshell files under /var/vpn/theme/, /netscaler/ns_gui/, /var/vpn/helpdesk/, or /netscaler/portal/; unexplained SUID modification on /bin/sh; and nsppe crashes or unexpected pitboss-triggered nsppe respawns
  • Confirm the August 19, 2026 Citrix patches for CVE-2026-19489 and CVE-2026-19490 (CTX696939) are deployed if not already, since that pair remains a live, KEV-listed exploitation vector distinct from the two new zero-days

Workarounds

  • No official Citrix workaround exists for the two unconfirmed new zero-days as of 2026-09-27
  • Some organizations have opted to shut down internet-exposed NetScaler appliances entirely as a precaution, at the cost of disrupting VPN, ICA proxy, and authentication services

Longer-term hardening

  • Deploy behavioral/EDR-style monitoring on NetScaler appliances (crash/respawn monitoring for nsppe and pitboss, unexpected child-process creation) since no signature-based IOCs exist yet for the unconfirmed new zero-days
  • Reduce and segment internet exposure of NetScaler management interfaces and Gateway/AAA vservers; VulnCheck has observed NetScaler management interfaces 'targeted en masse in recent threat campaigns'
  • Institutionalize a post-patch compromise-assessment step for every future NetScaler advisory, per watchTowr CEO Benjamin Harris's warning that 'patching alone won't cut it' if a backdoor was already planted before the fix shipped

Affected and fixed versions

  • Cloud Software Group (Citrix) — NetScaler ADC
    Vulnerable versions: undisclosed as of 2026-09-27 - watchTowr has not named affected builds or configurations pending Citrix's advisory
    Fixed in: not yet released as of 2026-09-27; Citrix communications and a fix are expected the week of 2026-09-28
  • Cloud Software Group (Citrix) — NetScaler Gateway
    Vulnerable versions: undisclosed as of 2026-09-27 - watchTowr has not named affected builds or configurations pending Citrix's advisory
    Fixed in: not yet released as of 2026-09-27; Citrix communications and a fix are expected the week of 2026-09-28
  • Cloud Software Group (Citrix) — NetScaler ADC and NetScaler Gateway (related, already-patched CVE-2026-19489/CVE-2026-19490)
    Vulnerable versions: 14.1 before 14.1-73.32; 13.1 before 13.1-63.21; 13.1-FIPS/NDcPP before 13.1-37.277
    Fixed in: 14.1-73.32 and later; 13.1-63.21 and later; 14.1-73.32 FIPS and later; 13.1-37.277 and later (FIPS/NDcPP)

Timeline

  • Citrix originally discloses the memory-overflow issue later tracked as CVE-2026-8452 in advisory CTX696604, describing it only as a denial-of-service condition.
  • watchTowr Labs publishes research escalating the CTX696604 DoS bug to unauthenticated pre-auth RCE (CVE-2026-8452) and separately documents a pre-auth SAML memory-overread flaw (CVE-2026-8451), both in NetScaler's SAML/XML handling.
  • Citrix publishes advisory CTX696939 disclosing CVE-2026-19490 (critical NetScaler Gateway/AAA authentication bypass, CVSS 9.3) and CVE-2026-19489 (SIP ALG/LSN memory overflow, CVSS 8.8); NCSC-NL issues advisory NCSC-2026-0318 covering the pair.
  • CISA adds CVE-2026-8452 to its Known Exploited Vulnerabilities catalog after observing webshells and discovery activity on compromised NetScaler appliances; federal remediation set for 2026-08-29.
  • A public exploit for CVE-2026-19490 appears on GitHub.
  • In-the-wild exploitation of CVE-2026-19490 begins, evidenced by sensor hits from multiple IPs and countries.
  • Singapore's Cyber Security Agency (CSA) warns that exploitation attempts against CVE-2026-19490 have been observed.
  • CISA adds CVE-2026-19490 to its KEV catalog citing evidence of active exploitation, with a federal remediation deadline of 2026-09-12.
  • watchTowr clarifies the two newly reported unpatched RCE flaws were identified during forensic (post-breach) investigations, verified with authoritative sources, and are distinct from the already-patched CVE-2026-19490.
  • NCSC-NL informally notifies Dutch organizations and advises immediate NetScaler shutdown, without yet issuing a new public advisory specific to the unpatched flaws.
  • A viral, unsourced post from "International Cyber Digest" claims an unnamed critical NetScaler zero-day is under active exploitation, triggering emergency shutdown orders by multiple governments and organizations.
  • watchTowr states it is "rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild," calling the intelligence credible and confirming it has notified watchTowr Platform clients of their NetScaler exposure.
  • Cybersecurity News and other outlets report the story; Citrix has not published CVE identifiers, affected builds, an advisory, or IOCs for the two zero-days, with communications and a fix expected 'early next week.'

Sources cited

Showing 15 of 17 sources, primary sources first.

Other reports on CVE-2026-19489

Other reports on CVE-2026-19490

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 17 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats