NetScaler RCE Zero-Days Reportedly Exploited as Admins Urged to Take Appliances Offline

The warnings started on Reddit. BleepingComputer reported that Citrix administrators said IT suppliers and security teams were privately contacting their organizations and advising them to shut down their NetScaler appliances. One admin wrote: "We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately". Other administrators said law enforcement, CERTs, and national cybersecurity agencies had also been contacting organizations about the issue.

What we know, and who says so​

Here is the timeline so far, with the source for each step:

• September 25: Tenable's Research Special Operations team says the first reports appeared in the r/Citrix subreddit. Posters described advice to shut down NetScalers and said it came from the Dutch national cyber security centre.
• September 26: Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. The firm's summary was blunt: "Two vulnerabilities – both RCE. Unpatched, 0days." It added that the flaws were found during forensic work and that Citrix communications and patches were expected early the following week.
• Also September 26: Researcher Kevin Beaumont added his own confirmation. As quoted by Tenable, he wrote: "The Netscaler zero day thing is real, being used in active attacks. No patch yet, if sensitive to Netscaler vulns switch it off."
• Citrix's response: BleepingComputer contacted Citrix about the reported zero-days but received no response.

The source is thin on some points. The Hacker News noted that watchTowr has published no evidence, named no victim, and has not said whose forensic investigations found the exploitation. That doesn't mean the warnings are wrong. Several independent parties are saying the same thing, and in Beaumont's words the threat "is real." It does mean that nothing public yet tells you which builds or configurations are affected.

Section summary: A research firm, an independent researcher and several private channels agree that two RCE zero-days are being exploited. Citrix hasn't confirmed it.

The Dutch NCSC pre-notification​

The most detailed account is a pre-notification that the Dutch National Cyber Security Centre (NCSC-NL) reportedly sent to organisations in the Netherlands. Copies circulated online. According to BleepingComputer's reading of it:

• A European partner CERT told the agency about two critical zero-days in NetScaler.
• Each flaw can lead to RCE on its own. One reportedly lets attackers place shellcode directly in memory. The second was still being analysed.
• No CVE IDs had been assigned, Citrix had no advisory out, and there were no indicators of compromise (IoCs) yet.
• Citrix reportedly found the flaws while doing incident response for customers, then filed a notification under the EU Cyber Resilience Act.
• Exploitation had been seen at multiple Citrix customers worldwide. The agency didn't know whether it was widespread.
• It warned that attacks could increase once patches and technical details are published.

Treat all of this as reported, not confirmed. The NCSC wouldn't confirm the document to BleepingComputer, saying the outlet was not part of its constituency. Tenable said it has not independently obtained or reviewed the notice either. Community members told Tenable it was distributed under TLP:AMBER+STRICT. That's the tightest sharing restriction in common use, which may be why some admins got the warning and others heard nothing.

Cyber Kendra found the same mixed picture on Reddit. One admin said their organisation shut its NetScalers down based on an NCSC notification. The notice arrived through the organisation's CERT team rather than the NCSC website, and management made the decision. Meanwhile, other administrators received nothing.

Not the August bug​

Don't confuse this with the NetScaler flaw you may have patched last month. Citrix's August 19 bulletin, CTX696939, covered two different issues:

That bulletin lists these fixed builds:

• 14.1-73.32 and later
• 13.1-63.21 and later
• 14.1-73.32 FIPS
• 13.1-37.277 for FIPS/NDcPP

Citrix says it applies only to customer-managed appliances. Secure Private Access Hybrid deployments that use NetScaler instances are also affected. Singapore's Cyber Security Agency warned on September 7 that exploitation attempts had been observed, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 9.

The new warning is separate. watchTowr says so, and Tenable agrees. The Hacker News also notes that Citrix has not said whether appliances on the August builds, 14.1-73.32 and 13.1-63.21, or any newer builds, are affected by the new flaws. Being on the August builds doesn't tell you whether you're exposed to the new flaws.

If you haven't applied the August fixes, do it anyway. You can check whether an appliance meets the CVE-2026-19490 preconditions by searching its running config for these strings, which come from Citrix's bulletin:

• add authentication samlAction.*
• add authentication vserver .*
• add vpn vserver .*

For CVE-2026-19489, search for add lsn group.*sipalg.*.

Section summary: The August bugs have patches and are a known risk. The new zero-days don't have patches and are separate.

Why this keeps happening to NetScaler​

NetScaler ADC and NetScaler Gateway sit at the edge of enterprise networks, where they handle VPN and remote access, load balancing, and user authentication. For a Windows shop, that often means the box in front of Citrix Virtual Apps, RDP proxying and SAML sign-in to Entra ID or AD FS. An attacker who gets code running there can see a lot of sensitive traffic.

Attackers have gone after it for years. Tenable counts 13 NetScaler-related entries in CISA's KEV catalog as of September 27, and 24 for Citrix products overall. The list includes CitrixBleed (CVE-2023-4966), CitrixBleed 2 (CVE-2025-5777) and CVE-2025-7775. Tenable also says that over the last seven years, roughly two-thirds of threat-actor activity against NetScaler came from advanced persistent threat (APT) groups, the state-linked kind. The other third came from ransomware gangs and their affiliates.

The ADC firmware rarely gets much of Patch Tuesday's attention, but attackers keep coming back to it.

What to do right now​

No Citrix guidance exists for these flaws yet. The steps below come from BleepingComputer's interim advice, Citrix's existing compromise-response guidance and past NCSC lessons. They're not a vendor fix.

• Decide whether the appliance stays online. BleepingComputer recommends taking internet-exposed NetScalers offline where possible. If you can't, restrict access to trusted networks and IP addresses. This is a business call, which is exactly why the NCSC sent a pre-notice: patching these appliances can mean downtime.
• Lock down management. Never expose the NetScaler management interface to the internet. Allow only trusted admin IPs.
• Treat community workarounds with care. Some Reddit users suggested allowlisting employee IPs, or disabling DTLS and watching the crash dumps folder. Cyber Kendra points out that none of this guidance comes from Citrix, and its effect on the unpublished flaws is unknown.
• Assume an early foothold is possible. The flaws were exploited before any patch existed, so patching only closes the door for new attackers. In 2025, the NCSC said that updating alone did not remove the risk, because an attacker could keep access gained before the patch.
• Use Citrix's existing compromise playbook if something looks wrong. The Hacker News summarises it as:
• Preserve evidence first: a VPX snapshot, logs from remote syslog servers and NetScaler Console, a technical support bundle, and a core dump of the packet engine.
• Isolate the appliance from the network.
• Rotate everything: change every service account password and secret stored on it, reset the passwords of users who signed in through it, and revoke its certificates and private keys. In Windows environments, that includes LDAP bind accounts and any Kerberos or SAML signing material held on the device.
• Verify the advisory before acting on it. When patches arrive, get the bulletin, affected versions and builds from Citrix's official support portal. Don't rely on reposts or firmware file names passed around in forums. Then plan a maintenance window. The NCSC notice warned that attacks may rise once details are public, so expect scanning to start soon after.

The bigger picture​

This is uncomfortable territory. Big "switch it off" decisions are being made on private intelligence the affected organisations often can't see. Some admins shut down critical remote-access infrastructure based on a TLP-restricted notice. Others learned about it from Reddit. The Cyber Resilience Act reporting chain seems to have got the warning to some national CERTs quickly. Whether it reached everyone who needed it is less clear.

Security firm Shattered.io put it this way: NetScaler has produced a serious vulnerability roughly every two to three months in 2026, and this is the first time this year that exploitation has started before a patch existed at all. Keep the appliance's exposure small, watch for Citrix's bulletin, and be ready to patch and investigate as soon as it lands.

Update: CISA confirms two NetScaler RCE zero-days are under active global exploitation (September 27, 2026)​

CISA has now confirmed Citrix’s disclosure of eight NetScaler ADC and Gateway vulnerabilities, assigning CVE-2026-88771 through CVE-2026-88778. It added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog, stating that both are critical zero-days that can independently enable remote code execution and are being actively exploited globally.

This replaces the earlier reliance on private warnings and third-party reporting: the affected flaws now have CVE identifiers, and CISA says partner intelligence and incident reports corroborate exploitation. Citrix has also published a security bulletin covering the eight CVEs and made indicators of compromise available through NetScaler Console.

CISA advises organisations to look for signs of compromise before updating where possible, because applying updates can reduce forensic visibility. Admins that suspect an intrusion should preserve evidence before patching, then follow Citrix’s mitigation and recovery guidance.

Update: Mandiant links CVE-2026-88772 attacks to web shells and internal-network tunneling (September 29, 2026)​

According to BleepingComputer’s report on Mandiant research, attackers exploiting CVE-2026-88772 have installed disguised PHP web shells, altered NetScaler’s Apache configuration to make apparent CSS, image, Debian-package, or signature-file requests execute PHP, and changed /bin/sh permissions to retain root-level command execution.

Mandiant tracked two previously undocumented payloads, WHIPSHOT and SLAPSHOT. WHIPSHOT acts as a web shell and proxy, while the Python-based SLAPSHOT tool can tunnel traffic from the compromised appliance to internal systems. In at least one intrusion, the attackers used that access for hands-on reconnaissance and credential theft. Mandiant says activity dates to at least early September and has affected organisations in North America and Europe across government, financial services, education, legal, and professional-services sectors.

For incident hunting, administrators should now inspect httpd.conf for unexpected PHP handlers, aliases, or AliasMatch rules; check for PHP embedded in suspicious .deb or .sig files; investigate unexplained NSPPE crashes and unusual fake 404 responses; and verify that /bin/sh has not been marked setuid-root. Mandiant also identifies /tmp/.uxdport and /tmp/.uxdlock as possible SLAPSHOT artifacts.

Disabling DTLS or blocking inbound UDP/443 can reduce exposure to CVE-2026-88772 where DTLS is unnecessary, but it does not protect against the separately exploited CVE-2026-88771. Applying Citrix’s current updates remains necessary for both flaws.