Zero‑Day RCE Flaws in Citrix NetScaler Found Exploited in the Wild

Security teams have confirmed that two previously unknown remote‑code‑execution vulnerabilities in Citrix NetScaler are being used in active attacks, according to a report from threat‑intelligence firm watchTowr.

The flaws, described as unpatched zero‑days, emerged during forensic examinations of compromised environments. watchTowr said investigators observed malicious payloads that leveraged the vulnerabilities to gain command‑level access to the appliance and, by extension, to internal networks.

NetScaler appliances serve as application‑delivery controllers and load balancers for thousands of enterprises, data centers and cloud providers. Their position at the edge of corporate networks makes them a high‑value target for attackers seeking to bypass perimeter defenses.

Because no vendor‑issued fix exists, organizations are advised to implement temporary mitigations such as restricting inbound traffic to management interfaces, enforcing strong authentication, and monitoring logs for unusual NetScaler activity. Incident‑response teams should also review network traffic for signs of exploitation and be prepared to isolate affected devices.

Citrix has acknowledged the report and indicated that a security advisory and patches are forthcoming. The disclosure underscores the broader challenge of zero‑day threats, prompting experts to call for faster vulnerability‑disclosure processes and more rigorous segmentation of critical infrastructure.