Active Exploits Target Unpatched Citrix NetScaler Zero‑Day Flaws, Vendor Yet to Respond

Security research firm watchTowr announced on September 26 that two previously unknown zero‑day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild. Both flaws allow unauthenticated remote code execution, giving attackers the ability to run arbitrary commands on vulnerable devices. Citrix has not confirmed the existence of the bugs nor released a remedial update.

The vulnerabilities reside in core components that handle traffic routing and secure remote access. Because they are unpatched, any organization that runs the affected NetScaler versions is exposed to a direct path for compromise. The lack of a public fix means that attackers can continue to leverage the flaws without immediate hindrance.

Citrix NetScaler appliances are a staple in many enterprise networks, providing load balancing, application delivery, and VPN services for thousands of corporate and cloud environments. Historically, vulnerabilities in these products have attracted sophisticated threat actors seeking persistent footholds. The emergence of active exploitation this early in the disclosure cycle raises the risk profile for any organization still relying on default configurations or legacy deployments.

Exploitation of remote code execution bugs can enable a range of malicious activities, from installing ransomware to exfiltrating sensitive data and moving laterally across internal systems. watchTowr’s observation of real‑world attacks suggests that the flaws are already being weaponized, potentially by groups that specialize in targeting critical infrastructure. Companies that depend on NetScaler for external-facing services are therefore urged to treat the threat as high priority.

In the absence of an official patch, security teams are advised to implement compensating controls. These include restricting inbound traffic to NetScaler appliances, enforcing strict firewall rules, deploying intrusion detection signatures that flag abnormal command sequences, and closely monitoring authentication and system logs for signs of compromise. Organizations should also engage with Citrix support to obtain any available workarounds and stay alert for forthcoming advisories.

The situation underscores the broader challenge of zero‑day management in complex enterprise environments. watchTowr expects that exploitation activity will persist until Citrix publishes a definitive fix, and the security community will likely share additional indicators of compromise as more data emerges. Stakeholders are encouraged to remain vigilant, prioritize rapid response measures, and coordinate with industry peers to mitigate the evolving risk.