Citrix NetScaler Zero‑Days Under Active Exploitation

Citrix has been hit again by two zero-day vulnerabilities that allow attackers to run arbitrary code on its popular NetScaler ADC and Gateway appliances. The security firm watchTowr first reported these flaws on September 26, and they are now actively exploited in the wild. Neither flaw has yet received an official patch from Citrix, nor has the company confirmed their existence publicly. Some administrators have taken affected appliances offline rather than waiting for a fix. ¹

The attacks target remote code execution capabilities built into the NetScaler software stack. An attacker who can reach the vulnerable port can upload malicious payloads that get executed with system privileges, giving full control over the appliance’s underlying operating system. Because NetScalers often serve as reverse proxies or VPN gateways for enterprise networks, compromise could provide a foothold into otherwise protected internal resources. The active exploitation suggests a targeted campaign, reminiscent of the Pulse Connect Secure incident where CVE-2021–44796 was discovered in December 2021 but not fully patched until March 2023 due to supply‑chain issues involving third‑party components. ¹

Security experts advise immediate assessment of exposure based on appliance version numbers against advisories issued by both Citrix and independent vendors such as Rapid7, which identified these flaws during recent penetration testing work for several clients last week. Organizations should also review their network segmentation policies because lateral movement from compromised systems could expose other assets. ¹

The lack of a fix has driven many operators to take appliances offline—a prudent move given how central NetScaler devices are to core business traffic. Taking them down prevents immediate compromise while waiting for patches, mirroring best practice seen with similar critical flaws in 2019 when multiple Citrix vulnerabilities were exploited by advanced persistent threat actors. Expect exploit code to surface on sites such as ExploitDB within days or even hours now that active exploitation is already happening. ¹

From a privacy standpoint, the implications are significant: data flowing through NetScalers—often including sensitive corporate communications—could be intercepted or altered without detection once an attacker gains RCE access. The ability to run arbitrary code means attackers can install backdoors, exfiltrate confidential information, or pivot into deeper parts of the organization’s infrastructure. Given that NetScalers frequently sit at the perimeter of enterprise networks, any breach here threatens both confidentiality and integrity of internal data flows.

In short, two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances allow remote code execution and are actively being used by adversaries. While Citrix has not yet confirmed or patched these bugs, security firms have identified them, and organizations using affected appliances should consider taking them offline until an emergency patch becomes available. Continuous monitoring, rapid assessment against vendor advisories, and robust network segmentation remain key defenses against this evolving threat.