Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Two unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances have been identified and are being actively exploited in the wild. The flaws allow remote code execution (RCE) and were disclosed by security firm watchTowr on September 26, 2026. Citrix has not yet confirmed the vulnerabilities or released any patches. In response to the active exploitation and lack of vendor guidance, some administrators have chosen to take their affected appliances offline. The situation represents a critical risk for organizations relying on these network appliances for application delivery and secure remote access. No CVE identifiers have been assigned yet based on available information.