Security firm watchTowr disclosed on September 26, 2026, that two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild. The vulnerabilities enable remote code execution without authentication. Citrix has not confirmed the flaws or released a patch, prompting some administrators to take appliances offline as a precaution.

Which products are affected?

NetScaler ADC, NetScaler Gateway

What should defenders do?

Until Citrix releases an official patch, organizations should consider taking affected NetScaler ADC and Gateway appliances offline, implementing network segmentation, and monitoring for unusual activity. watchTowr and the security community urge immediate action to reduce exposure.

criticalzero-day

watchTowr Reports Actively Exploited Zero-Days in Citrix NetScaler ADC and Gateway

Two unpatched vulnerabilities allow remote code execution; Citrix has not confirmed or patched the flaws

CyberIntel DeskPublished 2 days agoUpdated less than a minute ago1 min read

watchTowr Reports Actively Exploited Zero-Days in Citrix NetScaler ADC and Gateway

Key Takeaways

Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are under active exploitation.
The flaws enable remote code execution without authentication.
Citrix has not confirmed the vulnerabilities or released a patch.
Administrators are taking appliances offline as a precaution while waiting for a fix.

Related Security News

criticalZero-Day

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Cybersecurity firms report that attackers are exploiting a zero-day vulnerability in Citrix NetScaler to deploy custom web shells and tunneling malware. The exploitation grants root access, enables credential theft, and facilitates lateral movement into internal networks. Citrix has released patches and security advisories addressing CVE-2026-88772.

BleepingComputerabout 6 hours ago1 min read