# Citrix NetScaler: Two Unpatched Zero-Day RCE Flaws Allegedly Exploited in the Wild (watchTowr Forensic Alert)

> watchTowr says it identified two separate, unpatched remote code execution vulnerabilities in Citrix NetScaler during forensic investigations, and that credible reporting indicates both are already being exploited in the wild. No CVE IDs, affected builds, CVSS scores, or IOCs have been published as of 2026-09-27; Citrix has not confirmed the flaws and communications/fixes are expected 'early next week.'

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2682
- **ID:** TL-2026-2682
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-19489, CVE-2026-19490

## Description

On 2026-09-26, security firm watchTowr said it was "rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild," characterizing the information as scarce but credible, and confirming that watchTowr Platform clients had already been notified of their NetScaler exposure. watchTowr subsequently stated the intelligence came from forensic (post-breach) investigations and had been verified with authoritative sources, describing two separate, unpatched vulnerabilities capable of remote code execution. watchTowr explicitly clarified that the newly reported flaws are distinct from CVE-2026-19490, the critical NetScaler Gateway/AAA authentication-bypass bug Citrix patched on 2026-08-19 and CISA added to its KEV catalog on 2026-09-09.

The alert triggered widescale confusion. A viral, unsourced post from the account "International Cyber Digest" claimed an unnamed 'critical' NetScaler zero-day was under active exploitation and prompted several governments and organizations to shut down internet-exposed NetScaler appliances immediately, disrupting VPN, ICA proxy, and authentication services. The Dutch National Cyber Security Centre (NCSC-NL) informally notified organizations and advised immediate shutdowns, though as of this writing it had not issued a new public advisory covering these specific unpatched flaws (its most recent published advisory, NCSC-2026-0318, covers the already-known CVE-2026-19489/CVE-2026-19490 pair). Reporting also noted that a considerable share of the panic may actually trace back to continued exploitation of the already-disclosed CVE-2026-19490 rather than the new zero-days, since that flaw has been under active, KEV-listed exploitation since at least 2026-09-03.

As of 2026-09-27, Citrix (Cloud Software Group) has not published CVE identifiers, affected builds, an advisory, technical exploitation details, or indicators of compromise for the two newly reported zero-days; watchTowr itself said it would not publicly disclose exploitation paths, prerequisites, payloads, or forensic artifacts ahead of vendor coordination. Citrix communications and patches are expected 'early next week' (week of 2026-09-28).

This alert lands squarely in watchTowr's established NetScaler research lineage. In mid-2026, watchTowr Labs disclosed CVE-2026-8451, a pre-auth SAML XML-parser memory overread ('CitrixBleed To Infinity And Beyond') that leaked adjacent heap memory and session-cookie (NSC_TASS) contents from the nsppe packet-processing engine, and CVE-2026-8452, a pre-auth heap overflow in SAML SignedInfo/InclusiveNamespaces canonicalization handling that watchTowr escalated from a DoS-only Citrix advisory (CTX696604) into full unauthenticated root RCE — including disabling appliance crash/reboot signal handlers and dropping a PHP webshell with a SUID /bin/sh. CISA added CVE-2026-8452 to its KEV catalog on 2026-08-26 after observing webshells and discovery activity on compromised appliances in the wild. Because Citrix has not yet disclosed the technical root cause of the two new unpatched flaws, this research documents the concrete, sourced exploitation pattern established across NetScaler's recent pre-auth RCE/auth-bypass disclosures (CVE-2026-19489, CVE-2026-19490, CVE-2026-8451, CVE-2026-8452) as the best-evidenced proxy for the exploitation class defenders should hunt for, while treating the two new zero-days themselves as unconfirmed pending Citrix's advisory.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1685 Disable or Modify Tools
- T1222.002 Linux and Mac Permissions
- T1212 Exploitation for Credential Access
- T1499.004 Application or System Exploitation

## Sources

- [Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/citrix-netscaler-0-day-rce-2/)
- [Unpatched NetScaler Zero-Days Exploited, watchTowr Says](https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html)
- [Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks](https://www.cryptika.com/citrix-netscaler-0-day-rce-vulnerabilities-actively-exploited-in-attacks/)
- [watchTowr: "rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild"](https://x.com/watchtowrcyber/status/2103891689857228803)
- [AGTP: Citrix NetScaler emergency shutdown orders explainer thread](https://x.com/AGTPinsights/status/2103914129333571670)
- [You're Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/)
- [CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)](https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/)
- [CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway](https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/)
- [Active Exploitation Alert: Citrix NetScaler ADC/Gateway Authentication Bypass (CVE-2026-19490) Added to CISA KEV — Patch and Forensic Triage Guidance](https://www.rescana.com/post/citrix-netscaler-cve-2026-19490-authentication-bypass-kev)
- [Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers](https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html)
- [Citrix NetScaler ADC & NetScaler Gateway Authentication Bypass and Memory Overflow Vulnerabilities (CVE-2026-19489 & CVE-2026-19490)](https://www.triskelelabs.com/resources/citrix-netscaler-adc-and-netscaler-gateway-authentication-bypass-and-memory-overflow-vulnerabilities-cve-2026-19489-cve-2026-19490)
- [CVE-2026-8452: Citrix NetScaler Pre-Auth RCE Disclosed by watchTowr — Detection, Hunting, and Remediation Guide](https://securityarsenal.com/blog/cve-2026-8452-citrix-netscaler-pre-auth-rce-disclosed-by-watchtowr-detection-hunting-and-remediation-guide)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Adds Six Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog)
- [Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)](https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2682