# Two Unpatched Citrix NetScaler ADC/Gateway RCE Zero-Days Under Active Exploitation

> Security firm watchTowr says two distinct, unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, discovered during forensic investigations of compromised environments. Citrix has issued no bulletin, CVE identifiers, affected-build list, or IOCs as of September 27, 2026; patches are expected early the week of September 28. The claim surfaced amid a viral, less-specific shutdown warning from the X account International Cyber Digest and a Dutch NCSC-NL pre-notification, and is explicitly distinct from the already-patched authentication-bypass CVE-2026-19490/CVE-2026-19489 pair (fixed August 19, 2026; CVE-2026-19490 added to CISA KEV September 9, 2026).

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2688
- **ID:** TL-2026-2688
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-19489, CVE-2026-19490

## Description

On September 26, 2026, threat-intelligence firm watchTowr disclosed that it had identified two separate, unpatched remote code execution (RCE) vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances, both already being exploited in the wild. watchTowr's account is unusual in its provenance: the firm says it found the flaws while performing forensic investigations for clients, i.e., the exploitation was discovered because organizations had already been compromised, rather than through proactive vulnerability research. As of this writing, Citrix has published no security bulletin, no CVE identifiers, no CVSS score, no confirmed list of affected builds, and no indicators of compromise for either flaw. watchTowr says it expects Citrix communications and a patch early in the week of September 28, 2026.

One of the two vulnerabilities is reported to allow an attacker to inject and run shellcode directly in memory on the appliance, without dropping a file to disk, which defeats file-based antivirus/EDR detection that many organizations rely on for appliance protection. No further technical detail (root cause, CWE class, authentication requirement, or specific affected virtual-server configuration) has been made public for either bug.

Subsequent reporting added technical color while still stopping short of vendor confirmation. One outlet framed the likely exploit chain as memory corruption -- a heap overflow, stack buffer overflow, or use-after-free -- paired with an information leak defeating ASLR/DEP, though this was reporter inference rather than a watchTowr or Citrix technical disclosure. The same reporting described plausible post-exploitation actions consistent with a file-less RCE -- spawning a reverse shell, creating rogue administrator accounts/sessions, or planting a web shell that never touches disk -- and cited Citrix's July 2026 CVE-2026-8452 (an unauthenticated RCE via a SAML-related heap overflow) as a comparable prior flaw class. Defender guidance published alongside these reports recommended watching for unexpected core dumps or service restarts under /var/core/ and /var/nslog/, unauthorized changes to the ns.conf master configuration file, rogue admin accounts or unfamiliar SAML identity-provider configuration, admin sessions from unexpected geographies, and unauthorized outbound connections from NetScaler appliance IP addresses -- offered as forensic hypotheses for a still-technically-undisclosed exploit rather than confirmed IOCs from an observed intrusion.

The disclosure landed inside a chaotic 24-48 hour information environment. A viral, far less specific post from the X account 'International Cyber Digest' claimed an 'unknown critical' NetScaler zero-day had prompted governments and organizations to shut down all NetScaler devices immediately, without technical substantiation. Managed service providers, MDR vendors, and national CERT/CSIRT teams reportedly relayed the same shut-it-down guidance to clients over the same weekend. The Dutch National Cyber Security Centre (NCSC-NL) issued advance/pre-notification guidance and is reported to have raised its advisory NCSC-2026-0318 rating to 'high'; NCSC-NL's early-warning posture is linked by some reporting to the EU Cyber Resilience Act (effective September 11, 2026), which obligates vendors to report actively-exploited vulnerabilities to European authorities while an internal investigation and fix are still in progress. Some reporting raises the possibility that part of the shutdown panic is downstream confusion with the already-known, already-patched CVE-2026-19490/CVE-2026-19489 authentication-bypass pair rather than confirmation of a wholly new bug class -- watchTowr, however, was explicit that the two RCEs it identified are unpatched and distinct from that prior pair.

The broader context matters for prioritization: CVE-2026-19490 (CWE-288, Authentication Bypass Using an Alternate Path or Channel; CVSS 9.3) was disclosed and patched by Citrix on August 19, 2026 (security bulletin CTX696939, alongside CVE-2026-19489), affecting NetScaler ADC/Gateway configured as an AAA virtual server or Gateway service (SSL VPN, ICA Proxy, CVPN, RDP Proxy). CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities (KEV) catalog on September 9, 2026, after observing active exploitation, with a Binding Operational Directive 26-04 remediation deadline of September 12, 2026 for U.S. federal civilian agencies, and forensic-triage guidance beyond simple patching. NetScaler 13.1 separately reached End of Maintenance on September 15, 2026, raising the question of whether that branch will receive a fix for the two new, still-unnamed RCEs at all. Citrix's own standing general-compromise guidance (CTX694799) instructs administrators who suspect any NetScaler compromise to preserve a VPX snapshot or forensic image, system time/NTP configuration, a Technical Support Bundle, and local/centralized logs before remediating, and to request Citrix Support's IOC-detection shell script via a Severity 2 ticket; it also reiterates that NetScaler Management Service interfaces should never be exposed to the public internet. Citrix NetScaler ADC/Gateway has a multi-year pattern of pre-authentication, internet-facing RCE and auth-bypass zero-days exploited at scale before patches exist (CitrixBleed CVE-2023-4966; CVE-2025-6543 and CVE-2025-7775/7776/8424 in 2025; CVE-2026-8451/8452/8655/10816/10817/13474 disclosed July 2026; CVE-2026-3055/CVE-2026-4368 exploited from March 2026), which is the backdrop against which defenders and regulators reacted so aggressively to an unconfirmed, undocumented pair of new bugs.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1620 Reflective Code Loading
- T1505.003 Web Shell
- T1136.001 Local Account
- T1556 Modify Authentication Process
- T1071 Application Layer Protocol

## Sources

- [Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html)
- [Citrix CTX694799 - General guidance for suspected NetScaler compromise](https://support.citrix.com/s/article/CTX694799)
- [Citrix CTX696939 - Security Bulletin: CVE-2026-19490 / CVE-2026-19489](https://support.citrix.com/s/article/CTX696939)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-19490](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490)
- [Unpatched NetScaler Zero-Days Exploited, watchTowr Says](https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html)
- [Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/citrix-netscaler-0-day-rce-2/amp/)
- [Citrix NetScaler Zero-Day Emergency: Why Organizations Are Shutting Down Appliances](https://thecybersecguru.com/news/citrix-netscaler-zero-day-shutdown/)
- [ETR: CVE-2026-19490 Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway](https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/)
- [AGTP: Citrix NetScaler emergency shutdown orders recap](https://x.com/AGTPinsights/status/2103914129333571670)
- [International Cyber Digest: viral unverified NetScaler zero-day claim](https://x.com/IntCyberDigest/status/2103864155493056635)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2688