# Two Unpatched Citrix NetScaler Zero-Day RCE Vulnerabilities Under Active Exploitation

> Security firm watchTowr and independent analyst Kevin Beaumont confirmed on September 26, 2026 that two distinct, unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, discovered during forensic investigations rather than vendor disclosure. No CVE identifiers, CVSS scores, affected-build guidance, technical root cause, or indicators of compromise have been published; Citrix has stated a fix is expected early in the week of September 28, 2026.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2693
- **ID:** TL-2026-2693
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-19489, CVE-2026-19490

## Description

On September 25, 2026, reports of active exploitation of a Citrix NetScaler zero-day began circulating publicly via a Reddit r/Citrix post, followed by a viral X/Twitter post from the account 'International Cyber Digest' claiming an 'unknown critical' NetScaler zero-day had prompted governments and organizations to shut down devices immediately. A Reddit user ('FastFredNL') separately claimed the Dutch National Cyber Security Center (NCSC-NL) had privately pre-notified Citrix of the flaws before advising affected organizations to power down appliances, and at least one administrator has stated they received a corresponding notification through their CERT team; outlet Cyber Kendra was unable to independently confirm either account, and NCSC-NL had published no public advisory of its own as of September 27, 2026. That viral claim initially caused confusion with the already-patched CVE-2026-19490 (an authentication-bypass vulnerability, CVSS 9.8/9.3, CWE-288, fixed by Citrix on August 19, 2026 and added to CISA's Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 12, 2026 remediation deadline). On September 26, 2026, security research firm watchTowr and independent security analyst Kevin Beaumont separately confirmed that the real story is distinct from CVE-2026-19490: two separate, unpatched remote-code-execution vulnerabilities in NetScaler ADC and NetScaler Gateway, exploited in the wild before any fix existed, discovered during forensic investigations. watchTowr explicitly stated: 'two vulnerabilities, both remote code execution, both unpatched, exploited before any fix existed,' and warned defenders not to conflate them with CVE-2026-19490.

As of this report (September 27, 2026), Citrix/Cloud Software Group has published no advisory, no CVE identifiers, no CVSS scores, no confirmed affected build ranges, no technical root-cause detail, no workaround, and no indicators of compromise for the two new zero-days. This near-total absence of vendor detail is itself an important data point: defenders are being asked to make containment decisions (keep online with monitoring, isolate, or power off) without the information normally used to scope exposure. It is also unclear whether the August 19, 2026 patched builds (14.1-73.32, 13.1-63.21) are also vulnerable to the new bugs, and NetScaler 13.1 reached End of Maintenance on September 15, 2026, raising doubt about whether it will receive a fix at all.

For scoping context, the two companion vulnerabilities patched on August 19, 2026 are: CVE-2026-19490 (CWE-288, Authentication Bypass Using an Alternate Path or Channel, CVSS v3.1 9.8 / CVSS v4.0 9.3, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, affecting NetScaler configured as a Gateway -- SSL VPN, ICA Proxy, CVPN, RDP Proxy -- or an AAA virtual server) and CVE-2026-19489 (CWE-120, buffer/memory overflow, CVSS v4.0 8.8, network-exploitable with no authentication required, primarily availability-impacting). CVE-2026-19490 itself was not exploited at disclosure but began seeing active exploitation attempts around September 3, 2026, shortly after a public PoC surfaced, ahead of CISA's September 9, 2026 KEV addition. Separately, watchTowr Labs publicly disclosed an unrelated, already-patched NetScaler pre-authentication RCE on August 14, 2026 (informally tracked as CVE-2026-8452), caused by a heap overflow during SAML 'ds:SignedInfo' XML canonicalization that let an oversized 'PrefixList'/'InclusiveNamespaces' value corrupt heap chunk metadata and ultimately overwrite a function pointer to redirect execution to shellcode; that bug was fixed in 14.1-72.61 / 13.1-63.18 and is NOT confirmed to be either of the two new unpatched zero-days, but demonstrates watchTowr's established track record of finding memory-corruption RCE bugs in NetScaler's XML/SAML handling.

NetScaler ADC/Gateway appliances have a long documented history of being targeted by both nation-state and financially motivated actors once a remote pre-auth bug becomes available: CISA advisory AA23-201A (July 20, 2023) documents threat actors exploiting CVE-2023-3519 to implant webshells on a critical-infrastructure operator's NetScaler ADC, followed by Active Directory enumeration via ldapsearch, credential extraction from configuration files, network/SMB discovery, and data exfiltration disguised as image-file uploads. The 2023 'CitrixBleed' vulnerability was separately exploited by LockBit 3.0 ransomware affiliates against Boeing's parts and distribution unit. No such attribution, victimology, or TTP detail has been published for the current September 2026 zero-days; threat_actor and motivation are recorded as Unknown/attribution-LOW pending Citrix's advisory and any follow-on incident reporting.

Because Citrix, watchTowr, and Beaumont have disclosed zero exploitation methodology, IOCs, or affected-build detail for the two new zero-days, the MITRE ATT&CK mapping in this record is necessarily modeled on the two most directly analogous, explicitly-sourced precedents rather than on confirmed facts about the new bugs themselves: (1) CISA advisory AA23-201A's forensic account of CVE-2023-3519 NetScaler ADC post-exploitation, which documents attacker PHP webshells written to /netscaler/ns_gui/vpn/ (including a shell dubbed SECRETSAUCE that decrypts attacker-supplied code with an embedded RSA key), ldapsearch-driven Active Directory/domain-trust/OU enumeration, SMB and port scanning across target subnets, setuid binaries (pykeygen, pip4) used to spawn root shells, modification of /flash/nsconfig/rc.netscaler for reboot-persistent webshells, data staged for exfiltration by renaming it with image/style-sheet extensions (e.g. cp .../test.tar.gz .../medialogininit.png), and use of LIGOLO-NG/NPS tunnellers plus compromised pfSense devices for multi-hop C2 proxying; and (2) watchTowr Labs' own August 2026 NetScaler pre-auth RCE research (CVE-2026-8452), which achieved code execution via a SAML '<SignedInfo>'/'InclusiveNamespaces' 'PrefixList' XML-canonicalization heap overflow that corrupts an adjacent heap chunk's metadata, obtains a write-what-where primitive through splitPktInner(), overwrites the privileged nsppe packet-engine's tx_pkt_complete_fptr function pointer to redirect execution into attacker-placed shellcode (i.e., process injection into a root-privileged daemon), neutralizes pitboss's SIGSEGV/SIGBUS/SIGABRT/SIGFPE crash-monitoring via sigaction(SIG_IGN) so the exploited nsppe process is silently respawned rather than triggering a visible reboot, and sets the SUID bit on /bin/sh to escalate the initially 'nobody'-context webshell to root. Neither precedent is confirmed to be the mechanism behind the September 2026 zero-days; they are cited as the best-evidenced expectation for this same vendor/appliance family absent any vendor disclosure, and the mapped techniques below should be read as anticipated/precedent-based rather than confirmed-observed for this specific threat.

Citrix's own suspected-compromise guidance (referenced in coverage of this event) instructs responders to preserve VPX snapshots, logs, technical support bundles, and core dumps; isolate the appliance from the network; reset all service-account and NetScaler-authenticated user credentials; revoke certificates and private keys; and keep the NetScaler Management Service off the public internet, stating it 'should never be exposed to the public internet.' The Dutch National Cyber Security Center (NCSC-NL) previously published 2025 check scripts for live appliances, core dumps, and NetScaler images to aid this kind of triage, though the scripts' own documentation notes they come with no guarantee of effectiveness. Some administrators have reportedly taken NetScaler appliances offline entirely rather than wait for Citrix's patch.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1548.001 Setuid and Setgid
- T1055 Process Injection
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1027.003 Steganography
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1649 Steal or Forge Authentication Certificates
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1090 Proxy
- T1499.004 Application or System Exploitation

## Sources

- [Frequently Asked Questions About Reported Citrix NetScaler Zero-Day Vulnerabilities](https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities)
- [Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html)
- [watchTowr (@watchtowrcyber) confirmation of two unpatched NetScaler RCE zero-days](https://x.com/watchtowrcyber/status/2103972792043479307)
- [CISA Known Exploited Vulnerabilities Catalog -- CVE-2026-19490 entry](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD -- CVE-2026-19490 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-19490)
- [NVD -- CVE-2026-19489 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-19489)
- [ETR: CVE-2026-19490 Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway](https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/)
- [Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/citrix-netscaler-0-day-rce-2/)
- [Citrix NetScaler Zero-Day Emergency: Why Organizations Are Shutting Down Appliances](https://thecybersecguru.com/news/citrix-netscaler-zero-day-shutdown/)
- [You're Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452)](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/)
- [CVE-2026-8452: Citrix NetScaler Pre-Auth RCE Disclosed by watchTowr -- Detection, Hunting, and Remediation Guide](https://securityarsenal.com/blog/cve-2026-8452-citrix-netscaler-pre-auth-rce-disclosed-by-watchtowr-detection-hunting-and-remediation-guide)
- [International Cyber Digest -- viral 'unknown critical' NetScaler zero-day post](https://x.com/IntCyberDigest/status/2103864155493056635)
- [AGTP -- Citrix NetScaler emergency shutdown orders thread](https://x.com/AGTPinsights/status/2103914129333571670)
- [Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a)
- [Citrix Gear Under Active Attack Again With Another Zero-Day](https://www.darkreading.com/vulnerabilities-threats/citrix-zero-day-under-active-attack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2693