Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Citrix NetScaler ADC and NetScaler Gateway unpatched zero-day RCE flaws remote code execution flaw

Vulnerability
First reported
Last updated
Happening score
H score 34
1 unique sources, 1 articles

Summary

Hide ▲

Citrix NetScaler ADC and NetScaler Gateway are affected by two unpatched zero-day RCE flaws that are actively exploited in the wild, putting edge appliances used for VPN and remote access at immediate compromise risk.

Related Happenings

Citrix NetScaler ADC / NetScaler Gateway zero-day RCE flaws remote code execution flaw (multiple vulnerabilities)

Vulnerability
H score43 First: 28.09.2026 09:24 Last: 28.09.2026 09:24 Sources 1

About this happening: Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 are under active exploitation against unmitigated NetScaler deployments, enabling unauthenticated remote c...

Latest development: 29.09.2026 21:37

Mandiant says attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 to install the WHIPSHOT PHP web shell and the SLAPSHOT Python tunneling tool, maintain root-level access, pivot into internal hosts, and steal credentials. The activity affected organizations in North America and Europe across government, financial services, education, legal, and professional services environments.

Open Happening

Citrix NetScaler unpatched RCE zero-days actively exploited remote code execution flaw

Vulnerability
H score34 First: 27.09.2026 19:02 Last: 27.09.2026 19:02 Sources 1

About this happening: Two Citrix NetScaler remote code execution zero-days are being exploited in the wild, putting exposed appliances at immediate risk before fixes arrive. Private warning...

Open Happening

Citrix NetScaler urgent patch guidance for CVE-2026-19490

Advisory/Mitigation
H score54 First: 04.09.2026 18:25 Last: 04.09.2026 18:25 Sources 1

About this happening: Citrix NetScaler administrators were told to urgently review exposure and upgrade impacted appliances for CVE-2026-19490, a CVSS 9.3 authentication-bypass flaw...

Open Happening

Citrix NetScaler authentication bypass (CVE-2026-19490)

Vulnerability
H score29 First: 04.09.2026 18:25 Last: 04.09.2026 18:25 Sources 1

About this happening: CVE-2026-19490 is now being actively probed in the wild, putting exposed Citrix NetScaler appliances at risk of remote authentication bypass. Previdian observe...

Open Happening

Citrix NetScaler ADC/Gateway memory overflow flaw (CVE-2026-8452)

Vulnerability
H score34 First: 27.08.2026 12:16 Last: 27.08.2026 12:16 Sources 1

About this happening: CVE-2026-8452 is an actively exploited memory overflow flaw in Citrix NetScaler ADC and NetScaler Gateway appliances, including systems configured with Gateway V...

Open Happening

Timeline

  1. 26.09.2026 03:00 2 articles · 15d ago

    watchTowr flags two actively exploited NetScaler RCE zero-days

    Initial Disclosure

    watchTowr said two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances were being actively exploited in the wild on September 26. It later described both flaws as remote code execution bugs, said they were exploited before any fix existed, and said they were discovered during forensic investigations; Citrix had not confirmed the flaws or published a fix.

    Show sources
    Open in new tab
  2. 26.09.2026 03:00 1 articles · 15d ago

    Administrators take NetScaler appliances offline after shutdown advice

    Untyped Phase

    Some administrators shut down or isolated Citrix NetScaler appliances after receiving advice to take them offline immediately, and Citrix's existing suspected-compromise guidance calls for preserving evidence, isolating the appliance, changing service account passwords and stored secrets, revoking certificates and private keys, and keeping the management interface off the public internet.

    Show sources
    Open in new tab