Two Unpatched Citrix NetScaler RCE Zero-Days Exploited in the Wild

Two remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being exploited in the wild with no patch available, according to security firm watchTowr. Citrix had not confirmed the flaws, issued a bulletin, or published a fix as of Sunday, September 27. There is no vendor workaround and no published indicators of compromise. Some administrators have already taken their appliances offline rather than wait.

NetScaler appliances terminate VPN sessions, broker remote access, balance load and authenticate users. Code execution on that box gives an attacker the credentials, session tokens, certificates and private keys that flow through it, plus a foothold inside the perimeter.

What watchTowr Said, and What It Did Not

watchTowr first posted on X on September 26 that it was responding to rumors of several unpatched NetScaler RCE vulnerabilities in the wild, adding: "While details are scarce, the information is credible." A follow-up at 22:19 UTC gave the fuller account: two vulnerabilities, both remote code execution, both unpatched, both exploited before any fix existed, both discovered during forensic investigations. It said Citrix communications and patches are expected early in the week of September 28 and directed further questions to Citrix.

watchTowr has published no technical evidence, named no victim and not said whose forensic investigations found the exploitation. The firm has a track record on this product: in August it showed that a NetScaler heap overflow Citrix patched in June could be turned into remote code execution.

Admins Are Pulling the Plug

Reports of shutdown advice appeared on Reddit the same day. An administrator on r/Citrix wrote that their IT supplier's security team phoned to advise shutting down their NetScalers immediately, without giving details. Others in the thread said their organizations had done the same. Where the suppliers' warning originated has not been established.

With no bulletin, the decision for every NetScaler owner right now comes down to three options: keep it online and accept the risk, isolate it, or power it off. The second decision is whether to treat it as already compromised. For any internet-facing appliance, the answer to that second question should be yes until you have evidence otherwise.

Patching Will Not Tell You If You Were Hit

Because exploitation happened before any fix existed, installing the patch closes the door but says nothing about who already walked through it. The precedent is recent. In 2025, after a NetScaler flaw was exploited as a zero-day against Dutch organizations, the Netherlands' National Cyber Security Center (NCSC-NL) warned that updating alone did not remove the risk, because attackers could retain access gained before the patch, and told administrators to run its check scripts.

Plan the patch window and the investigation as two separate jobs. Capture evidence before you patch, reboot or reimage, because each of those can destroy the artifacts you need.

Citrix's Existing Compromise Guidance

Citrix already publishes a playbook for a suspected NetScaler compromise. It applies here:

• Preserve evidence first: snapshot VPX instances, pull logs held on remote syslog servers and NetScaler Console, generate a technical support bundle, and capture a core dump of the packet engine.
• Isolate the appliance from the network.
• Rotate every service account password and secret stored on the appliance, reset passwords for users who authenticated through it, and revoke its certificates and private keys.
• Keep the management interface off the internet. In Citrix's words: "The NetScaler Management Services should never be exposed to the public internet."

The NCSC-NL 2025 check scripts cover a live appliance, core dumps and full NetScaler images. They have limits. The live-appliance README says the script looks for files that indicate compromise, is not specific to any one vulnerability, and carries no guarantee of effectiveness. The code was last updated in September 2025, so it will not know about artifacts unique to these new flaws. A clean result is a data point, not a clearance.

The 13.1 Problem

NetScaler 13.1 reached End of Maintenance on September 15, twelve days before this disclosure. Citrix has not said whether 13.1 will receive a fix. If you still run 13.1, start planning the move to 14.1 now: you may be forced to upgrade major versions under active exploitation, with no guarantee a 13.1 build is coming.

What to Do Before Monday

• Inventory every NetScaler ADC and Gateway, including forgotten VPX instances in cloud tenants, and record the exact build of each.
• Confirm the NSIP and management services are unreachable from the internet. Fix that today regardless of the zero-days.
• Collect a tech support bundle and VPX snapshot from each internet-facing appliance now, while the evidence is intact.
• Decide per appliance: isolate, power off, or keep online with elevated monitoring. Document who accepted the risk.
• Stage credential rotation for service accounts, LDAP bind accounts and certificates stored on the appliance so it can run the moment you confirm or suspect compromise.
• Watch Citrix's security bulletin page and the CISA KEV catalog for the advisory expected the week of September 28, and patch immediately when it lands, after evidence capture.

ssh nsroot@"$NS_HOST" 'show ns version'

ssh nsroot@"$NS_HOST" 'shell find /netscaler/ns_gui /var/vpn /var/netscaler/logon -type f -mtime -30 -ls'

curl -sk -o /dev/null -m 10 -w '%{http_code}\n' "https://$NS_PUBLIC_IP/"

ssh nsroot@"$NS_HOST" 'show techsupport'

scp -r nsroot@"$NS_HOST":/var/tmp/support ./netscaler-evidence-$(date +%Y%m%d)

ssh nsroot@"$NS_HOST" 'shell shutdown -p now'